Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

CVE-2026-75061: Improper Limitation of a Pathname to a Restricted Directory

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

CVE-2026-18541: Improper Neutralization of Input During Web Page Generation

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-17475: Improper Authorization

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control...

PT-2026-111095

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper output encoding allows a remote authenticated attacker to execute arbitrary JavaScript. This issue occurs when the application fails to correctly sanitize or encode data befo...

PT-2026-111094

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing "dot dot" sequences /../, an attacker can write arbitrary files ...

PT-2026-111093

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper validation of file paths allows a remote attacker to read arbitrary host files and overwrite specific application files. Recommendations At the moment, there is no informatio...

PT-2026-111092

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper validation of sub-requests allows a remote attacker to bypass authentication and escalate privileges. Recommendations At the moment, there is no information about a newer...

PT-2026-111090

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended functionality, which could...

CVE-2026-19627: Improper Limitation of a Pathname to a Restricted Directory

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths...

CVE-2026-19620: Authentication Bypass Using an Alternate Path or Channel

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication...

PT-2026-111089

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper functional level access control allows a remote authenticated attacker to delete folders and applications belonging to other users. Recommendations At the moment, there is no...

CVE-2026-85457: Stack-based Buffer Overflow

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

PT-2026-111091

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper authentication may allow a remote attacker to gain unauthorized administrative access. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-75063: Improper Neutralization of Input During Web Page Generation

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding...

CVE-2026-19622: Authentication Bypass Using an Alternate Path or Channel

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

sysflow

SysFlow: Pipeline de telemetría de sistemas nativos en la nube Este repositorio alberga la documentación y el rastreador de incidencias para todos los proyectos de SysFlow. Referencia rápida Documentación : la Documentación de SysFlow Dónde obtener ayuda : el Slack de la Comunidad SysFlow Dónde...

Malicious code in @myorder-frontend-commons/analytics (npm)

Source: ossf-package-analysis 43a2fe0052005fedc0434fc354ae8777e198113f2371fddfbc9d79ffdd87fbb5 The OpenSSF Package Analysis project identified '@myorder-frontend-commons/analytics' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated...

Malicious Package

Overview @myorder-frontend-commons/analytics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

MAL-2026-17749 Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...