CVE-2025-36290

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36290 IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36271: Use of a One-Way Hash without a Salt

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

PT-2026-83319

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

PT-2026-83320

Name of the Vulnerable Software and Affected Versions IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 Description The system fails to properly validate TLS certificates. This flaw allows an attacker to perform man-in-the-middle techniques to intercept and obtain sensitive...

CVE-2025-36290: Improper Certificate Validation

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by an uncontrolled resource consumption vulnerability due to Apache HttpComponents Core

Summary Apache HttpComponents Core is used by IBM Integrated Analytics System as a Java library providing low-level HTTP transport components. CVE-2026-54399 affects the HTTP/1.1 message parser in Apache HttpComponents Core versions 5.4.2 and earlier, where insufficient limits on the number and...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to pyOpenSSL

Summary pyOpenSSL is used by IBM Integrated Analytics System as a Python wrapper around the OpenSSL library for SSL/TLS functionality. Multiple vulnerabilities affect pyOpenSSL versions prior to 26.0.0. CVE-2026-27448 involves a "fail open" behavior where an unhandled exception in a user-provided...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a deserialization vulnerability due to PLY (Python Lex-Yacc)

Summary PLY Python Lex-Yacc is used by IBM Integrated Analytics System as a Python parsing library implementing lex and yacc tools. CVE-2025-56005 affects PLY version 3.11 due to deserialization of untrusted data CWE-502. This critical vulnerability could allow a remote attacker, without any...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a vulnerability due to Apache Commons HttpClient

Summary Apache Commons HttpClient is used by IBM Integrated Analytics System as an HTTP client library. CVE-2012-5783 affects Apache Commons HttpClient 3.1 due to improper SSL certificate hostname verification. The library fails to verify that the server hostname matches the domain name in the...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limits the number of bytes that can be read via i2c to I2CSMBUSBLOCKMAX. The commit effa453168a7 “i2c: i801: Do not silently correct invalid transfer size” revealed that ee1004eepromread does not properly limit th...

CVE-2026-71880 Server-side template injection in Integrated Publishing Toolkit

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

CVE-2026-71880

GBIF Integrated Publishing Toolkit (versions before 3.3.4) has a server-side template injection vulnerability in its template engine. Remote authenticated attackers with low privileges can inject untrusted input into templates, achieving high confidentiality and integrity impact (CVSS 7.6) by rea...

CVE-2026-71880 Server-side template injection in Integrated Publishing Toolkit

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

CVE-2026-71879

GBIF Integrated Publishing Toolkit versions before 3.3.4 leave initial setup functionality unauthenticated until first reboot, allowing remote authenticated attackers to bypass authentication and gain administrative control. CVSS 4.0 scores it 9.1 CRITICAL (network, low complexity, no privileges ...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...

CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...