Security Bulletin: HTTP request smuggling vulnerability in Go net/http due to improper LF handling in chunked encoding, affects watsonx.data

Summary The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. This could affect watsonx.data...

Security Bulletin: Sensitive Key Exposure in Snowflake JDBC Driver Logging (Versions 3.0.13 – 3.23.0), affects watsonx.data

Summary Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver "Driver" in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would log locally the client-side...

Security Bulletin: Reflected File Download (RFD) Vulnerability in Spring Framework Content-Disposition Header Handling (CWE-113), which affects IBM watsonx.data

Summary A Reflected File Download RFD vulnerability has been identified in VMware Spring Framework versions 6.0.5 to 6.2.7. The issue arises when an application sets a Content-Disposition response header using ContentDisposition.BuilderfilenameString, Charset with a non-ASCII charset and...

Security Bulletin: Pip Vulnerability Prior to v23.3 Allows Arbitrary Mercurial Configuration Injection via VCS URLs, which affects IBM watsonx.data

Summary When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how and whi...

Security Bulletin: Security Vulnerability in Requests Library: .netrc Credential Leak Fixed in Version 2.32.4, affects IBM watsonx.data

Summary Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can...

Security Bulletin: urllib3 Redirect Control Vulnerability in Pyodide Runtime (Versions 2.2.0 to <2.5.0), which affects IBM watsonx.data

Summary urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This...

EUVD-2025-29868

Malicious code in bioql PyPI...

EUVD-2025-29859

Malicious code in bioql PyPI...

EUVD-2025-29862

Malicious code in bioql PyPI...

CVE-2025-36144

IBM Lakehouse watsonx.data 2.2 stores potentially sensitive information in log files that could be read by a local user...

IBM Watsonx.data Log Information Disclosure Vulnerability

IBM Watsonx.data is an open data lake warehouse platform from International Business Machines IBM. IBM Watsonx.data suffers from a log information disclosure vulnerability that stems from storing potentially sensitive information in log files, which can be exploited by an attacker to cause it to ...

CVE-2025-36144

IBM Lakehouse watsonx.data 2.2 stores potentially sensitive information in log files that could be read by a local user...

CVE-2025-36144 IBM watsonx.data information disclosure

IBM Lakehouse watsonx.data 2.2 stores potentially sensitive information in log files that could be read by a local user...

CVE-2025-36144 IBM watsonx.data information disclosure

IBM Lakehouse watsonx.data 2.2 stores potentially sensitive information in log files that could be read by a local user...

CVE-2025-36144

CVE-2025-36144 affects IBM Lakehouse (watsonx.data 2.2). The vulnerability arises from logging potentially sensitive information, allowing a local user to read log files and disclose data. Affected component/file is the logging path used by watsonx.data, with root cause described as information d...

PT-2025-39696

Name of the Vulnerable Software and Affected Versions IBM Lakehouse watsonx.data version 2.2 Description The software stores potentially sensitive information in log files. A local user could read these log files, leading to information disclosure. Recommendations At the moment, there is no...

Security Bulletin: IBM Lakehouse stores potentially sensitive information in log files that could be read by a local user, affects watsonx.data

Summary IBM Lakehouse stores potentially sensitive information in log files that could be read by a local user. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2025-36144 DESCRIPTION: IBM Lakehouse stores potentially sensitive information in log files that could be read by a local...

IBM Watsonx.data OS Command Injection Vulnerability

IBM Watsonx.data is an open data lake warehouse platform from International Business Machines IBM. An operating system command injection vulnerability exists in IBM Watsonx.data version 2.2 that stems from not properly validating user input and can be exploited by an attacker to cause a privilege...

CVE-2025-36143

IBM Lakehouse watsonx.data 2.2 could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input...

CVE-2025-36139

IBM Lakehouse watsonx.data 2.2 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...