Security Bulletin: IBM webMethods Integration Sever is affected by privilege escalation vulnerability via pub.scheduler.addOneTimeTask service

Summary IBM webMethods Integration Sever is affected by privilege escalation vulnerability via pub.scheduler.addOneTimeTask service. CVE-2025-36048 Vulnerability Details CVEID:CVE-2025-36048 DESCRIPTION: IBM webMethods Integration could allow a privileged user to escalate their privileges when...

Malicious code in jimu-layouts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d65e335b07773d41eec063c08f22dfd26f8bbb4ea165ab0080df6f0d105f9e2a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: The Mailbox User Interface of IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnearble to XSS (CVE-2024-54183)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway has addressed XSS in the mailbox user interface Vulnerability Details CVEID:CVE-2024-54183 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway is vulnerable to cross-site scripting. This vulnerability allows an...

Arbitrary Argument Injection

Overview cloudinary is a Cloudinary NPM for node.js integration Affected versions of this package are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to domain certificate spoofing due to the OkHostnameVerifier.java package ( CVE-2021-0341)

Summary OkHostnameVerifier.java is used by DataStage on Cloud Pak for Data as part of hostname verification. Vulnerability Details CVEID:CVE-2021-0341 DESCRIPTION: In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly...

Security Bulletin: Dashboard UI of IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to Stored Cross-Site Scripting (CVE-2025-1349)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the stored cross-site scripting vulnerability. Vulnerability Details CVEID:CVE-2025-1349 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to stored cross-site scripting. This vulnerability allo...

Security Bulletin: Security Vulnerability in Apache Commons IO Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2024-47554)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Apache Commons IO Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to Incorrect Authorization issues (CVE-2024-55905)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the authorization issue. Vulnerability Details CVEID:CVE-2024-55905 DESCRIPTION: IBM Sterling B2B Integrator could allow an unauthenticated user to connect to groups that they should not have access to due to incorre...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to Cross-Site Requset Forgery (CVE-2024-54172)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to a cross-site request forgery vulnerability Vulnerability Details CVEID:CVE-2024-54172 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition is vulnerable to cross-site request forgery which could allow an...

Security Bulletin: IBM Fusion and IBM Fusion HCI are vulnerable to request smuggling due to python package h11 (CVE-2025-43859)

Summary The python package h11 is used by IBM Fusion and IBM Fusion HCI as part of the Content Aware Storage service and the Backup and Restore service agent and is vulnerable to request smuggling under certain conditions due to CVE-2025-43859 in h11. Vulnerability Details CVEID:CVE-2025-43859...

CVE-2025-6091

A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack...

Security Bulletin: Apache Parquet Common Vulnerability reported in Cloudera offerings with IBM. Fixes available from Cloudera.

Summary On April 1, 2025, a critical vulnerability in the parquet-avro module of Apache Parquet CVE-2025-30065, CVSS score 10.0 was announced. Vulnerability Details CVEID:CVE-2025-30065 DESCRIPTION: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows ba...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Inefficient Regular Expression Complexity due to golang/net package ( CVE-2024-45338 )

Summary Potential vulnerabilities in golang/net package CVE-2024-45338 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-45338 DESCRIPTION: An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Inefficient Regular Expression Complexity due to axios ( CWE-1333)

Summary Potential vulnerabilities in axios module has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details IBM X-Force ID: 386108 DESCRIPTION: axios is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the format method. By...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Race Condition due to moby ( CVE-2024-36621 )

Summary Potential vulnerabilities in moby package CVE-2024-36621 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-36621 DESCRIPTION: moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Server-Side Request Forgery (SSRF) due to axios package( CVE-2025-27152 )

Summary Potential vulnerabilities in axios package CVE-2025-27152 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rathe...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Inefficient Regular Expression Complexity due to cross-spawn ( CVE-2024-21538 )

Summary Potential vulnerabilities in cross-spawn module CVE-2024-21538 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-21538 DESCRIPTION: Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Prototype Pollution due to ejs package ( CVE-2024-33883)

Summary Potential vulnerabilities in ejs package has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-33883 DESCRIPTION: The ejs aka Embedded JavaScript templates package before 3.1.10 for Node.js lacks certain pollution protection. CWE:CWE-693:...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to improper Input Validation due to kube-controller-manager (CVE-2024-0793)

Summary Potential vulnerabilities in kube module CVE-2024-0793 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-0793 DESCRIPTION: A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lackin...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to Improper Input Validation due to kube package ( CVE-2024-9042 )

Summary Potential vulnerabilities in kube package CVE-2024-9042 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-9042 DESCRIPTION: This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the...