Security Bulletin: IBM Watson Studio on Cloud Pak for Data is vulnerable to a cross-site scripting vulnerability

Summary Watson Studio on Cloud Pak for Data is vulnerable to cross-site scripting within the Web UI CVE-2025-33116 Vulnerability Details CVEID:CVE-2025-33116 DESCRIPTION: IBM Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitra...

CVE-2025-57444

Radware AlteonOS Web UI Management (v33.0.4.50) has an authenticated XSS in the Administrative interface caused by insufficient validation of the Description parameter, enabling injection of arbitrary web scripts/HTML. Documented impact is arbitrary script execution within the authenticated user ...

PT-2025-40293

Name of the Vulnerable Software and Affected Versions Radware AlteonOS Web UI Management version 33.0.4.50 Description A security issue exists in the Administrative interface of Radware AlteonOS Web UI Management. An attacker with authentication can inject a crafted payload into the Description...

Radware AlteonOS Web UI Management 安全漏洞

Radware AlteonOS Web UI Management is a web management page from Radware Israel. A security vulnerability exists in Radware AlteonOS Web UI Management version 33.0.4.50, which stems from insufficient validation of the Description parameter input and could lead to a cross-site scripting attack...

CVE-2025-36132

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

CVE-2025-36132

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

CVE-2025-36132 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

CVE-2025-36132 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

PT-2025-39830

Name of the Vulnerable Software and Affected Versions IBM License Metric Tool versions 9.2.0 through 9.2.40 Description The software is susceptible to stored cross-site scripting. An authenticated user can embed arbitrary JavaScript code within the Web UI, potentially altering functionality and...

CVE-2025-36239

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-33116

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-54831

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was...

CVE-2025-20327

A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a...

CVE-2025-33116 IBM Watson Studio on Cloud Pak for Data cross-site scripting

IBM Watson Studio 4.0 through 5.2.0 on Cloud Pak for Data is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Vulnerabilities fixed in Cisco IOS and Cisco IOS XE Software

Cisco has fixed vulnerabilities in Cisco IOS and Cisco IOS XE Software. The vulnerabilities include several issues, including a buffer overflow in the command-line interface CLI that can lead to unexpected device restarts and a vulnerability in the TACACS+ protocol implementation that allows...

PT-2025-39409

Name of the Vulnerable Software and Affected Versions IBM Watson Studio versions 4.0 through 5.2.0 on Cloud Pak for Data Description An authenticated user can embed arbitrary JavaScript code in the Web UI, potentially altering intended functionality and leading to credentials disclosure within a...

CVE-2025-20327

CVE-2025-20327 : Cisco IOS Software web UI vulnerability caused by improper input validation. An authenticated, low-privilege attacker can craft a URL in an HTTP request to trigger a reload and DoS. The issue affects the Cisco IOS/Web UI and has a CVSS:3.1 base score of 7.7 (Network, Low Privileg...

Cisco IOS Software Industrial Ethernet Switch Device Manager Denial of Service Vulnerability

A vulnerability in the web UI of Cisco IOS Software could allow an authenticated, remote attacker with low privileges to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a...

PT-2025-39297

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A flaw exists in the web UI of Cisco IOS XE Software that could allow a remote attacker to perform a reflected cross-site scripting XSS attack. This is caused by insufficient...

PT-2025-39304

Name of the Vulnerable Software and Affected Versions Cisco IOS Software affected versions not specified Description A flaw exists in the web UI of Cisco IOS Software that may allow a remote attacker with low privileges to trigger a denial of service DoS condition. This is caused by improper inpu...