501 matches found
Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition
Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.0.0 Vulnerability Details CVEID:CVE-2023-36807 DESCRIPTION: pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5...
Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data version 5.3 Vulnerability Details CVEID:CVE-2025-41242 DESCRIPTION: Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a...
Security Bulletin: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data vulnerable to Deserialization of Untrusted Data due to jackson-core
Summary jackson-core is used by IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data in the repo huts-common Vulnerability Details WSID: WS-2022-0468 DESCRIPTION: The jackson-core package is vulnerable to a Denial of Service DoS attack. The methods in the classes listed below fail to...
Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data version 5.2.2 Vulnerability Details CVEID:CVE-2025-45767 DESCRIPTION: jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim o...
Security Bulletin: Vulnerabilities in Apache Kafka Client affects IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary Summary: Potential vulnerability in Apache Kafka Client has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-27817...
Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Cross-Site Scripting (XSS), specifically Mutation XSS (mXSS) due to dompurify
Summary dompurify is used by IBM watsonx Orchestrate Developer Edition as part of image: wxo-builder-ui Vulnerability Details CVEID:CVE-2025-26791 DESCRIPTION: DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting mXSS...
Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Open Redirect / Server-Side Request Forgery (SSRF) bypass due to Python
Summary Python is used by IBM watsonx Orchestrate Developer Edition as part of image: tools-runtime-manager Vulnerability Details CVEID:CVE-2025-50182 DESCRIPTION: urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control...
Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in net/http/internal CVE-2025-22871
Summary Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in net/http/internal CVE-2025-22871 Vulnerability Details CVEID:CVE-2025-22871 DESCRIPTION: The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This...
Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Server-Side Request Forgery (SSRF) due to ip
Summary ip is used by IBM watsonx Orchestrate Developer Edition as part of image: tools-runtime Vulnerability Details CVEID:CVE-2024-29415 DESCRIPTION: The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and...
EUVD-2025-175950
Malicious code in throw-bad-orchestrate-analyze-cat npm...
EUVD-2025-177409
Malicious code in orchestrate-grid-dog-air-route npm...
EUVD-2025-177411
Malicious code in orchestrate-awk-encrypt-moon-fork npm...
EUVD-2025-178898
Malicious code in finally-notify-table-orchestrate-sigma npm...
EUVD-2025-180208
Malicious code in authorize-interface-psi-orchestrate-visualize npm...
Malicious code in orchestrate-awk-encrypt-moon-fork (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c37f89d8c089dcfad0ba9ccd12ae226e2a797b3337fad8b5f9809995d826d545 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178374
Malicious code in interface-awk-balance-epsilon-orchestrate npm...
Malicious code in function-assert-orchestrate-theta-cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced639df901c0d1de13cbfbcff06848335dd6fd1617517443157c3e3ee78e72c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176830
Malicious code in quick-orchestrate-resolve-cat-tau npm...
MAL-2025-188862 Malicious code in promise-meta-node-orchestrate-proxy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a5d73de94d6841eb4dd5821707f352f8bee1c512dad1e7a52a134db5697862e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...