Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Python. Vulnerability Details CVEID:CVE-2023-24329 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by a flaw in the urllib.parse component. By sending a...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in LibTIFF

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of LibTIFF. Vulnerability Details CVEID:CVE-2022-48281 DESCRIPTION: LibTIFF is vulnerable to a denial of service, caused by a heap-based buffer overflow in the processCropSelections function in...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Node.js. Vulnerability Details CVEID:CVE-2022-25869 DESCRIPTION: Node.js angular module is vulnerable to cross-site scripting, caused by improper validation of user-supplied input when caching pages...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Angular

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Angular. Vulnerability Details CVEID:CVE-2023-26117 DESCRIPTION: AngularJS is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the $resource service...

Security Bulletin: Watson Query potentially exposes adminstrator's key under some conditions due to CVE-2022-22410

Summary Watson Query is vulnerable to an internal attacker who can use an exposed administrator APIKEY to potentially alter system configuration or view customer data. The APIKEY is used to automatically create connections and assets to help reduce workload for the user. However, in some...

Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data

Summary This bulletin addresses multiple vulnerabilities in Data Virtualization on IBM Cloud Pak for Data. Note that Data Virtualization is rebranded to Watson Query starting in IBM Cloud Pak for Data version 4.6. Vulnerability Details CVEID:CVE-2022-37598 DESCRIPTION: Node.js UglifyJS module cou...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Framework denial of service vulnerabilitiy [CVE-2023-20863]

Summary Potential VMware Tanzu Spring Framework denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-20863 Vulnerability Details...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache Spark privilege escalation vulnerabilitiy [ CVE-2023-22946]

Summary Potential Apache Spark privilege escalation vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-22946 Vulnerability Details CVEID:CVE-2023-22946...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js Request module denial of service vulnerabilitiy [ CVE-2023-28155]

Summary Potential Node.js Request module denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-28155 Vulnerability Details...

WordPress Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Framework denial of service vulnerabilitiy [CVE-2023-20863]

Summary Potential VMware Tanzu Spring Framework denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-20863 Vulnerability Details...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to RubyGems commonmarker gem denial of service vulnerabilitiy [IBM X-Force ID: 252809]

Summary Potential RubyGems commonmarker gem denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability has been addressed. Refer to details for additional information. IBM X-Force ID: 252809 Vulnerability Details IBM...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restriction bypass in VMware Tanzu Spring Boot (CVE-2023-20873)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restriction bypass in VMware Tanzu Spring Boot, caused by a flaw with wildcard pattern matching when deployed on Cloud Foundry CVE-2023-20873. VMware Tanzu Spring Boot is used as part of our Speech...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in VMware Tanzu Spring Framework (CVE-2023-20863)

Summary Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in VMware Tanzu Spring Boot, caused by improper input validation CVE-2023-20863. VMware Tanzu Spring Framework is used as part of our Speech Service microservices. This...

Security Bulletin: Watson CP4D Data Stores is vulnerable to Golang Go denial of service vulnerability ( CVE-2022-23806)

Summary Potential Golang Go denial of service vulnerability CVE-2022-23806 has been identified that may affect Watson CP4D Data Stores Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-23806 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a...

Security Bulletin: IBM Cloud Pak for Data Affected by Malicious File Upload Vulnerability (CVE-2022-36769)

Summary IBM Cloud Pak for Data could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-36769 DESCRIPTION: IBM Cloud Pak for Data could allow a...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to GNU Libtasn1 information disclosure vulnerability [CVE-2021-46848]

Summary Potential GNU Libtasn1 information disclosure vulnerability has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. This vulnerability has been addressed. Refer to details for additional information. CVE-2021-46848 Vulnerability Details CVEID:CVE-2021-46848...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulnerabilities in Python

Summary Potential vulnerabilities in Python have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. These vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2021-28861 DESCRIPTION: Python could allow a...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulnerabilities in Perl

Summary Potential vulnerabilities in Perl have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. These vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2020-12723 DESCRIPTION: Perl is vulnerable to a...

CVE-2023-28955

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704...