Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to snappy-java information disclosure vulnerabilitiy [CVE-2023-20883]

Summary Potential VMware Tanzu Spring Boot denial of service, vulnerability caused by a flaw when Spring MVC is used together with a reverse proxy cache have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details fo...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable toSalesforce tough-cookie arbitrary code execution vulnerabilitiy [CVE-2023-26136]

Summary Potential Salesforce tough-cookie arbitrary code execution vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-26136 Vulnerability Details...

Security Bulletin: IBM Watson AI Gateway for IBM Cloud Pak for Data is vulnerable to Node.js semver package denial of service vulnerabilitiy [ CVE-2022-25883]

Summary Potential Node.js semver package denial of service vulnerabilitiy have been identified that may affect IBM Watson AI Gateway for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2022-25883 Vulnerability Details...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libssh denial of service vulnerability [CVE-2023-3603]

Summary libssh denial of service vulnerability CVEID: CVE-2023-3603 have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-3603 DESCRIPTION:...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple Node.js vulnerabilities

Summary Multiple Node.js vulnerabilitiies have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-32005 DESCRIPTION: Node.js could allow a remot...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libssh security bypass vulnerabilitiy [ CVE-2023-2283]

Summary Potential libssh security bypass vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-2283 Vulnerability Details CVEID:CVE-2023-2283 DESCRIPTION:...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Go HTML injection vulnerability [CVE-2023-24540]

Summary Go HTML injection vulnerability CVEID: CVE-2023-24540 have been identified that affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Go is...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache Ivy information disclosure vulnerabilitiy [CVE-2023-46751]

Summary Apache Ivy information disclosure vulnerabilitiy CVE-2023-46751, caused by improper handling of XML external entity XXE declarations by the XML parser. have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to snappy-java information disclosure vulnerabilitiy [CVE-2023-43642]

Summary Potential snappy-java denial of service, vulnerability caused by caused by missing upper bound check on chunk length have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Netty denial of service vulnerabilitiy [ CVE-2023-34462]

Summary Potential Go Nett denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-34462 Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTIO...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libssh denial of service vulnerabilitiy [ CVE-2023-1667]

Summary Potential libssh denial of service vulnerabilitiy have been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. The vulnerability have been addressed. Refer to details for additional information. CVE-2023-1667 Vulnerability Details CVEID:CVE-2023-1667 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime may affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2023-22081, CVE-2023-22067, CVE-2023-4807 & CVE-2023-5676)

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Version 11 used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Semeru Runtime may affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2023-22006, CVE-2023-22036 & CVE-2023-22049)

Summary There are multiple vulnerabilities in IBM® Semeru Runtime Version 11 used by IBM Decision Optimization for IBM Cloud Pak for Data. IBM Decision Optimization for IBM Cloud Pak for Data has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-22049 DESCRIPTION: An unspecified...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in QOS.ch Sarl Logback

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of QOS.ch Sarl Logback. Vulnerability Details CVEID:CVE-2023-6378 DESCRIPTION: QOS.ch Sarl Logback is vulnerable to a denial of service, caused by a serialization flaw in the receiver component. By...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2023.

Summary Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation 21.0.3-IF028 and 23.0.1-IF006. Vulnerability Details CVEID:CVE-2023-45857 DESCRIPTION: Axios is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js CVE-2023-44487. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to arbitrary code execution due to Babel.

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to arbitrary code execution due to Babel CVE-2023-45133. Vulnerability Details CVEID:CVE-2023-45133 DESCRIPTION: Babel could allow a local attacker to execute arbitrary code on the system, caused by a...

Security Bulletin: A vulnerability in NSS may affect IBM Robotic Process Automation for Cloud Pak and result in a remote attacker obtaining sensitive information (CVE-2023-4421).

Summary NSS is used by IBM Robotic Process Automation for Cloud Pak as part of Watson NLP. CVE-2023-4421. Vulnerability Details CVEID:CVE-2023-4421 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox, could allow a remote authenticated attacker to obtain sensitive...

Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation for Cloud Pak.

Summary XZ is used by IBM Robotic Process Automation for Cloud Pak as part of base container images, Watson NLP and WebSphere Liberty. CVE-2020-22916. File is used by IBM Robotic Process Automation for Cloud Pak as part of the base container images, Watson NLP and WebSphere Liberty. CVE-2022-4855...

Security Bulletin: Vulnerabilities in Groovy affect IBM Cloud Pak System [CVE-2016-6814, CVE-2015-3253]

Summary Vulnerabilities in Groovy affect IBM Cloud Pak System. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2016-6814 DESCRIPTION: Apache Groovy could allow a remote attacker to execute arbitrary code on the system, caused by a...