Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a denial of service vulnerability due to Apache HttpComponents Client

Summary Apache HttpComponents Client is used by IBM Integrated Analytics System as an HTTP client library for Java applications. CVE-2026-64607 affects classic I/O-based Apache HttpClient versions 5.0-alpha1 through 5.6.2, where the client fails to properly release underlying connections back to...

Security Bulletin: IBM Integrated Analytics System (IIAS) dashDB component is affected by multiple vulnerabilities due to Apache Spark

Summary The dashDB component in IBM Integrated Analytics System uses Apache Spark for distributed data processing. Multiple vulnerabilities affect Apache Spark, including OS command injection in the Spark UI ACL component, unencrypted local disk storage of user data, encryption key recovery in RP...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an HTTP request smuggling vulnerability due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Integrated Analytics System as a web server and servlet container. CVE-2026-19203 affects Eclipse Jetty due to accepting a lone line-feed LF character as a terminator in chunked request parsing such as in chunk extensions, chunk data termination, or trailer...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a path traversal vulnerability due to Apache Ant

Summary Apache Ant is used by IBM Integrated Analytics System as a Java-based build and task execution tool. CVE-2026-78254 affects Apache Ant versions prior to 1.10.18, where the ftp and scp tasks allow a malicious server or a machine-in-the-middle attacker to provide relative paths during file...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

CVE-2025-36290

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36290 IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36290: Improper Certificate Validation

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36271: Use of a One-Way Hash without a Salt

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

PT-2026-83320

Name of the Vulnerable Software and Affected Versions IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 Description The system fails to properly validate TLS certificates. This flaw allows an attacker to perform man-in-the-middle techniques to intercept and obtain sensitive...

PT-2026-83319

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a deserialization vulnerability due to PLY (Python Lex-Yacc)

Summary PLY Python Lex-Yacc is used by IBM Integrated Analytics System as a Python parsing library implementing lex and yacc tools. CVE-2025-56005 affects PLY version 3.11 due to deserialization of untrusted data CWE-502. This critical vulnerability could allow a remote attacker, without any...

Security Bulletin: Vulnerability in Dojo affects IBM Integrated Analytics System[CVE-2021-23450]

Summary The Dojo package is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addresed the applicable CVE CVE-2021-23450. Vulnerability Details CVEID:CVE-2021-23450 DESCRIPTION: All versions of package dojo are vulnerable to Prototype Pollution via the setObject functio...

EUVD-2025-25664

Malicious code in bioql PyPI...

Security Bulletin: Vulerability commons-fileupload affects IBM Integrated Analytics System

Summary The commons-fileupload package is used by IBM Integrated Analytics System as part of its file upload processing functionality. A denial-of-service DoS vulnerability was identified in Apache Commons FileUpload due to insufficient limits on multipart headers, which could allow a remote...

CVE-2025-36174

IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...

CVE-2025-36174

IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...

CVE-2025-36174

CVE-2025-36174 affects IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.30.0. A vulnerability in the file-upload feature allows an authenticated user to upload files with dangerous types, which could be executed by another user when opened. Root cause identified as unrestricted...

CVE-2025-36174 IBM Integrated Analytics System file upload

IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...

CVE-2025-36174: Unrestricted Upload of File with Dangerous Type

IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...