Security Bulletin: Watson Knowledge Catalog InstaScan is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary Watson Knowledge Catalog InstaScan uses Apache Log4j as part of its logging infrastructure. Hence it is vulnerable to denial of service CVE-2021-45105 and arbitrary code execution CVE-2021-45046. The fix includes Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-45105 DESCRIPTION...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Go. Vulnerability Details CVEID: CVE-2021-38561 DESCRIPTION: Golang Go Text is vulnerable to a denial of service, caused by an improper index calculation that allows an incorrectly formatted language tag to...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of XStream. Vulnerability Details CVEID: CVE-2021-43859 DESCRIPTION: XStream is vulnerable to a denial of service, caused by improper input validation. By injecting highly recursive collections or maps, a remote...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in TensorFlow

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of TensorFlow. Vulnerability Details CVEID: CVE-2022-21741 DESCRIPTION: TensorFlow is vulnerable to a denial of service, caused by a divide-by-zero condition in the implementation of depthwise convolutions in...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of FasterXML jackson-databind. Vulnerability Details Third Party Entry: 217968 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by an error when using JDK serialization to...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Spring. Vulnerability Details CVEID: CVE-2021-22060 DESCRIPTION: VMware Tanzu Spring Framework could allow a remote authenticated attacker to bypass security restrictions, caused by improper input validation...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in NumPy

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of NumPy. Vulnerability Details CVEID: CVE-2021-41496 DESCRIPTION: NumPy is vulnerable to a denial of service, caused by a buffer overflow in the arrayfrompyobj function of fortranobject.c. By constantly creatin...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2021-35550, CVE-2021-35603)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by Watson Explorer and Watson Explorer Content Analytics Studio. Watson Explorer and Watson Explorer Content Analytics Studio have addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-35550...

Security Bulletin: Vulnerability in IBM Java Runtime affects Watson Explorer and Watson Explorer Content Analytics Studio (CVE-2021-35578)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 8 used by Watson Explorer and Watson Explorer Content Analytics Studio. Watson Explorer and Watson Explorer Content Analytics Studio have addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-35578 DESCRIPTIO...

Security Bulletin: Vulnerability in [All] Spring Framework - CVE-2021-22060 (Publicly disclosed vulnerability) impacts IBM Watson Machine Learning Accelerator

Summary Spring Framework is used IBM Watson Machine Learning Accelerator. This bulletin provides mitigations for the addressable vulnerability CVE-2021-22060 by upgrading addressable to latest version. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

IBM Engineering Requirements Quality Assistant Denial of Service Vulnerability

IBM Engineering Requirements Quality Assistant is a Watson AI-based software from IBM USA used to assist developers in improving the quality of engineering requirements. The application significantly reduces the cost of finding defects, facilitates early detection of requirements errors in the...

Security Bulletin: IBM Watson Knowledge Catalog (with Information Server) is affected by a Cryptographic vulnerability

Summary A Cryptographic vulnerability was addressed by IBM Watson Knowledge Catalog with Information Server. Vulnerability Details CVEID: CVE-2019-4220 DESCRIPTION: IBM InfoSphere Information Server stores a common hard coded encryption key that could be used to decrypt sensitive information. CVS...

Security Bulletin: Apache Log4j vulnerability impacts IBM Watson Knowledge Catalog in Cloud Pak for Data (CVE-2021-44228)

Summary IBM Watson Knowledge Catalog in Cloud Pak for Data is vulnerable to arbitrary code execution due to Apache Log4j CVE-2021-44228 and is used for logging. Customers are encouraged to take quick action to update their systems to Apache Log4j 2.15.0. Vulnerability Details CVEID: CVE-2021-4422...

Security Bulletin: IBM Answer Retrieval for Watson Discovery is vulnerable to phishing attacks due to Swagger UI (CVE number(s) 221508)

Summary Swagger UI is used by IBM Answer Retrieval for Watson Discovery. CVE numbers 221508. The fix upgrades to Swagger UI v4.6.2. Vulnerability Details Third Party Entry: 221508 DESCRIPTION: Swagger UI could allow a remote attacker to conduct phishing attacks, caused by an open redirect...

Security Bulletin: Vulnerability in IBM Java Runtime affects Watson Explorer Content Analytics Studio ( CVE-2021-2341)

Summary There is a vulnerability in IBM® Runtime Environment Java™ Version 8 used by Watson Explorer Content Analytics Studio. Watson Explorer Content Analytics Studio has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2021-2341 DESCRIPTION: An unspecified vulnerability in Java SE...

Security Bulletin: IBM OpenPages with Watson has addressed Apache Log4j vulnerability (CVE-2021-44832)

Summary There is a security vulnerability in the Apache Log4j open source library used by IBM OpenPages with Watson. This impacts the IBM OpenPages logging framework. This vulnerability has been addressed. Vulnerability Details CVEID: CVE-2021-44832 DESCRIPTION: Apache Log4j could allow a remote...

WordPress "Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer" plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer" plugin versions = 1.0.0. Solution No patched version available...

WordPress "Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer" plugin <= 1.0.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer" plugin versions = 1.0.0. Solution No patched version available...

Security Bulletin: Vulnerability in Node.js- CVE-2021-22959, CVE-2021-22960 may affect IBM Watson Assistant for IBM Cloud Pak for Data.

Summary Potential vulnerabilities in Node.js CVE-2021-22959, CVE-2021-22960 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID: CVE-2021-22959 DESCRIPTION: Node.js is vulnerable to HTTP...

Security Bulletin: Vulnerability in Node.js-CVE-2021-23362, CVE-2021-22921, CVE-2021-22918, CVE-2021-27290 may affect IBM Watson Assistant for IBM Cloud Pak for Data.

Summary Potential vulnerabilities in Node.js CVE-2021-23362, CVE-2021-22921, CVE-2021-22918, CVE-2021-27290 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION:...