CVE-2025-33116

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

IBM Watson Studio Cross-Site Scripting Vulnerability

IBM Watson Studio is a data science and machine learning platform from IBM, integrated into Cloud Pak for Data, for building, training and deploying AI models. A cross-site scripting vulnerability exists in IBM Watson Studio versions 4.0 through 5.2.0 that stems from not adequately filtering user...

CVE-2025-33116

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-33116

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-33116

IBM Watson Studio on Cloud Pak for Data versions 4.0–5.2.0 are affected by CVE-2025-33116, a cross-site scripting flaw caused by insufficient input filtering in the Web UI that could allow an authenticated user to inject arbitrary JavaScript and potentially disclose credentials in a trusted sessi...

CVE-2025-33116 IBM Watson Studio on Cloud Pak for Data cross-site scripting

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-33116 IBM Watson Studio on Cloud Pak for Data cross-site scripting

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Security Bulletin: Vulnerabilities in pbkdf2 affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerabilities in pbkdf2 has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

IBM Watson Studio 跨站脚本漏洞

IBM Watson Studio is a data science and machine learning platform from IBM, integrated into Cloud Pak for Data, for building, training and deploying AI models. A cross-site scripting vulnerability exists in IBM Watson Studio versions 4.0 through 5.2.0 that stems from not adequately filtering user...

Security Bulletin: Due to use of Connect2id Nimbus JOSE+JWT, IBM Watson Studio in Cloud Pak for Data is affected by denial of service

Summary Connect2id Nimbus JOSE+JWT is used by Watson Studio in Cloud Pak for Data. Vulnerability Details CVEID:CVE-2023-52428 DESCRIPTION: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration cou...

IBM Watson Studio on Cloud Pak for Data Cross-Site Scripting Vulnerability

IBM Watson Studio on Cloud Pak for Data is an intelligent search and text analytics platform from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Watson Studio on Cloud Pak for Data versions 4.0 and 5.0, which stems from the application's lack of effective...

CVE-2024-49790

IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessi...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Recursion vulnerability in Apache Commons [CVE-2025-48924]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Recursion vulnerability in Apache Commons Lang, caused by the methods ClassUtils.getClass... possibily throwing a StackOverflowError on very long inputs CVE-2025-48924. Apache Commons is used in our speech service...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a request smuggling vulnerability in net/http [CVE-2025-22871]

Summary IBM Watson Speech Services Cartridge is vulnerable to a request smuggling vulnerability in net/http, caused by a condition where the package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines CVE-2025-22871. Net/http is used as part of our speech utilities...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a path traversal vulnerability in rsync [ CVE-2024-12087]

Summary IBM Watson Speech Services Cartridge is vulnerable to a path traversal vulnerability in rsync, caused by a behavior enabled by the --inc-recursive option, a default-enabled option for many client options, that can be enabled by the server even if not explicitly enabled by the client...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a path traversal vulnerability in rsync [CVE-2024-12088]

Summary IBM Watson Speech Services Cartridge is vulnerable to a path traversal vulnerability in rsync, due to an issue when using the --safe-links option, where the client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Handling of Case Sensitivity in Apache Tomcat [CVE-2025-46701]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Handling of Case Sensitivity in Apache Tomcat, due to an issue where GCI servlet allows a security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Apache Tomcat [CVE-2025-31650]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Apache Tomcat, caused by incorrect error handling for some invalid HTTP priority headers, resulting in incomplete clean-up of the failed request, which creates a memory leak CVE-2025-31650 Apache Tomcat ...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Spring [CVE-2025-22235]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Input Validation in Spring , caused by Spring Boot EndpointRequest.to creating the wrong matcher if the actuator endpoint is not exposed CVE-2025-22235 . Spring is used as part of our Java Microservices. This vulnerabilitiy...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improper Access Control vulnerability in Apache HttpClient [CVE-2025-27820]

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improper Access Control vulnerability in Apache HttpClient 5.4.x , due to a bug in PSL validation logic that disables domain checks, affecting cookie management and host name verification CVE-2025-27820. Apache HttpClient is used as...