2154 matches found
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in Golang crypto/internal/nistec [CVE-2025-22866]
Summary IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in the Golang crypto/internal/nistec package, due to the usage of a variable time instruction in the assembly implementation of an internal function, which may allow a small number of bits of secret...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to certification errors in golang.org/x/crypto/ssh [CVE-2024-45341]
Summary IBM Watson Speech Services Cartridge is vulnerable to certification errors in golang.org/x/crypto/ssh, because of conditions which incorrectly satisfy a URI name constraint that applies to certificate chains. CVE-2024-45341. Golang.org/x/crypto/ssh is used as part of our speech utilities...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in golang.org/x/crypto/ssh [CVE-2025-22869]
Summary IBM Watson Speech Services Cartridge is vulnerable to a denial of service in golang.org/x/crypto/ssh, due to a flaw in SSH servers which implement file transfer protocols CVE-2025-22869. Golang.org/x/crypto/ssh is used as part of our speech utilities. This vulnerabilitiy has been addresse...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an arbitrary code execution in Jinja [CVE-2025-27516]
Summary IBM Watson Speech Services Cartridge is vulnerable to arbitrary code execution in Jinja, due to an oversight in how the Jinja sandboxed environment interacts with the |attr filter CVE-2025-27516. Jinja is used in our speech runtimes. This vulnerabilitiy has been addressed. Please read the...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a' use after free' condition in libxml2 [CVE-2024-56171]
Summary IBM Watson Speech Services Cartridge is vulnerable to a' use after free' condition due to a flaw in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c CVE-2024-56171. libxml2 is used as part of our speech utilities. This vulnerabilitiy has been addressed. Please...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a stack-based buffer overflow in libxml2 [CVE-2025-24928]
Summary IBM Watson Speech Services Cartridge is vulnerable to a stack-based buffer overflow in libxml2, caused by a flaw in xmlSnprintfElements in valid.c CVE-2025-24928. libxml2 is used as part of our speech utilities. This vulnerabilitiy has been addressed. Please read the details for remediati...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a misinterpretation of input in proxy host matching [CVE-2025-22870]
Summary IBM Watson Speech Services Cartridge is vulnerable to a misinterpretation of input in proxy host matching, caused by improper addressing of an IPv6 zone ID as a hostname component CVE-2025-22870. Proxy host matching is used as part of our speech utilities. This vulnerabilitiy has been...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to asymmetric resource consumption in golang-jwt [CVE-2025-30204]
Summary IBM Watson Speech Services Cartridge is vulnerable to asymmetric resource consumption in golang-jwt, due to a flaw in the , the function parse.ParseUnverified splits CVE-2025-30204. Golang-jwt is included as part of our speech utilities. This vulnerabilitiy has been addressed. Please read...
Security Bulletin: A vulnerability in Watson NLP affects IBM Robotic Process Automation (CVE-2024-56171).
Summary A vulnerability in Watson NLP affects IBM Robotic Process Automation CVE-2024-56171. Watson NLP is used by IBM Robotic Process Automation for Natural Language Processing. This bulletin identifies the fixes required to address the vulnerablity. Vulnerability Details CVEID:CVE-2024-56171...
Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to a man-in-the-middle vulnerability in RFC7250 Raw Public Keys [CVE-2024-12797]
Summary IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to a man-in-the-middle vulnerability in RFC7250 Raw Public Keys RPKs, due to server authentication failure which is susceptible to man-in-the-middle attack CVE-2024-12797. RFC7250 Raw Public Keys are used in our Speech service...
Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to Remote Code Execution in Transformers [CVE-2024-11392, CVE-2024-11393, CVE-2024-11394]
Summary IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to Remote Code Execution in Transformers, due to a lack of proper validation of user-supplied dataCVE-2024-11392, CVE-2024-11393, CVE-2024-11394. This vulnerabilitiy has been addressed. Please read the details for remediation below...
Security Bulletin: IBM Watson Discovery Cartridge is affected by vulnerability in tomcat-embed-core-10.1.33.jar
Summary IBM Watson Discovery Cartridge contains a vulnerable version of tomcat-embed-core-10.1.33.jar Vulnerability Details CVEID:CVE-2025-24813 DESCRIPTION: Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to...
CVE-2024-49340
IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2024-37526
IBM Watson Query on Cloud Pak for Data IBM Data Virtualization 1.8, 2.0, 2.1, 2.2, and 3.0.0 could allow an authenticated user to obtain sensitive information from objects published using Watson Query due to an improper data protection mechanism...
CVE-2024-35151
IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs...
CVE-2024-35160
IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration...
CVE-2023-28955
IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704...
CVE-2023-30444
IBM Watson Machine Learning on Cloud Pak for Data 4.0 and 4.5 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 253350...