CVE-2023-30444

IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to uncontrolled resource consumption due to commons-io.

Summary Commons.io is used by the ds-runtime microservice as part of the read/write functionality. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to LDAP injection due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-25613 DESCRIPTION: Apache Kerby could allow a remote attacker to conduct an LDAP injection, caused by a flaw in LdapIdentityBackend. By sending a request with ...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to remote security bypass due to Node.js package

Summary Node.js is used by the DataStage on Cloud Pak for Data ds-canvas service as part of Javascript processing. Vulnerability Details CVEID:CVE-2023-39331 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by a path traversal bypass when verifying file...

Security Bulletin: Vulnerability in paramiko affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2023-48795]

Summary The paramiko package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVEs CVE-2023-48795. Vulnerability Details CVEID:CVE-2023-48795 DESCRIPTION: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH befo...

Security Bulletin: IBM Cloud Pak for Data is vulnerable due to github.com/golang/net ( CVE-2023-3978, CVE-2023-45288 )

Summary github.com/golang/net is used by IBM Cloud Pak for Data as part of the platform. CVE-2023-3978, CVE-2023-45288. Vulnerability Details CVEID:CVE-2023-3978 DESCRIPTION: Golang html package is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote...

CVE-2024-37526

IBM Watson Query on Cloud Pak for Data IBM Data Virtualization 1.8, 2.0, 2.1, 2.2, and 3.0.0 could allow an authenticated user to obtain sensitive information from objects published using Watson Query due to an improper data protection mechanism...

CVE-2024-37526

The CVE-2024-37526 entry concerns IBM Watson Query on Cloud Pak for Data (IBM Data Virtualization) up to version 3.0.0. Affected products publish objects to catalogs where only the first N columns are governed (N = 100 in older CPD versions; 1000 in CPD 5.0.0), due to an improper data protection ...

PT-2025-2501 · Ibm · Ibm Watson Query

Name of the Vulnerable Software and Affected Versions: IBM Watson Query on Cloud Pak for Data IBM Data Virtualization versions 1.8 through 3.0.0 Description: The issue allows an authenticated user to obtain sensitive information from objects published using Watson Query due to an improper data...

CVE-2024-41739

IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion...

IBM Cognos Dashboards on Cloud Pak for Data 代码问题漏洞

IBM Cognos Dashboards on Cloud Pak for Data is a business intelligence tool from International Business Machines IBM. A code issue vulnerability exists in IBM Cognos Dashboards on Cloud Pak for Data versions 4.0.7 and 5.0.0 that stems from dependency obfuscation...

IBM watsonx.ai 跨站脚本漏洞

IBM watsonx.ai is a library from International Business Machines IBM, Inc. Allows the use of the watsonx.ai service on IBM Cloud and IBM Cloud for Data. A cross-site scripting vulnerability exists in IBM watsonx.ai versions 1.1 through 2.0.3 and IBM watsonx.ai on Cloud Pak for Data versions 4.8...

The vulnerability of the data analysis tool from IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data arises due to synchronization errors when using a shared resource, allowing a malicious actor to trigger a service failure.

The vulnerability of the IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data data analysis service lies in synchronization errors when using a shared resource. Exploiting this vulnerability can allow a malicious actor to cause a service failure...

CVE-2024-49353

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to resources that are used concurrently, which might lead to unexpected states, possibly resulting in a crash...

PT-2024-9572 · Ibm · Ibm Watson Speech Services Cartridge For Ibm Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data versions 4.0.0 through 5.0.2 Description: The issue is caused by synchronization errors when using a shared resource, potentially allowing a remote attacker to cause a denial of...

CVE-2024-35160

IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration...

Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to a bypass security (CVE-2024-35195)

Summary There is a security bypass in psf Requests used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2024-35195 DESCRIPTION: Psf Requests could allow a local...

IBM Db2 权限许可和访问控制问题漏洞

IBM Db2 is a relational database management system from International Business Machines IBM. The system is implemented in UNIX, Linux, IBMi, z/OS, and Windows server versions. A privilege permission and access control issue vulnerability exists in IBM Db2 on Cloud Pak for Data and Db2 Warehouse o...

Security Bulletin: IBM Cloud Pak for Data Scheduling is vulnerable to remote authentication attack due to Kubernetes Scheduler code ( CVE-2023-5528 )

Summary Kubernetes Scheduler code is used by IBM Cloud Pak for Data Scheduling as part of the scheduling binaries. CVE-2023-5528. Vulnerability Details CVEID:CVE-2023-5528 DESCRIPTION: Kubernetes kubelet could allow a remote authenticated attacker to gain elevated privileges on the system, caused...

Security Bulletin: Vulnerability in babel affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)[CVE-2021-42771]

Summary The babel package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVECVE-2021-42771 Vulnerability Details CVEID:CVE-2021-42771 DESCRIPTION: Python-Babel Babel could allow a local authenticated attacker to traverse directories o...