Veille CVE

Recherche « IBM Cloud Pak for Data »

58 CVE

Critique 6 Élevée 41 Moyenne 11 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM Cloud Pak for Data » ✕
  1. CVE-2026-81212 10.0 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.

  2. CVE-2026-84418 7.4 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.

  3. CVE-2026-82110 9.9 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

  4. CVE-2026-82108 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  5. CVE-2026-82103 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

  6. CVE-2026-82101 9.6 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

  7. CVE-2026-82096 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  8. CVE-2026-84421 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.

  9. CVE-2026-82094 7.1 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.

  10. CVE-2026-82093 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.

  11. CVE-2026-81552 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.

  12. CVE-2026-81549 7.7 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.

  13. CVE-2026-81548 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  14. CVE-2026-81547 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal.

  15. CVE-2026-81545 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  16. CVE-2026-81539 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  17. CVE-2026-81537 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.

  18. CVE-2026-81536 7.7 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

  19. CVE-2026-81208 7.7 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments.

  20. CVE-2026-80423 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts.

  21. CVE-2026-80425 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  22. CVE-2026-80412 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.

  23. CVE-2026-80379 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  24. CVE-2026-17102 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  25. CVE-2026-16672 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  26. CVE-2026-16469 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  27. CVE-2026-16468 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.

  28. CVE-2026-16346 9.9 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  29. CVE-2025-14754 8.8 Élevée

    IBM Cloud Pak for Data

    IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

  30. CVE-2025-14753 7.5 Élevée

    IBM Cloud Pak for Data

    IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

  31. CVE-2026-11864 6.5 Moyenne

    IBM Cloud Pak for Business Automation

    IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.

  32. CVE-2026-17467 8.2 Élevée

    IBM Cloud Pak for Data System (Yosemite 1.0)

    IBM Cloud Pak for Data System (Yosemite 1.0) 3.0.5.2 could allow a remote attacker to obtain sensitive information due to the use of weak or deprecated cryptographic protocols.

  33. CVE-2026-16673 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.

  34. CVE-2026-16466 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.

  35. CVE-2026-16432 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

  36. CVE-2026-16428 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

  37. CVE-2026-16338 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

  38. CVE-2026-16335 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.

  39. CVE-2026-82107 9.6 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication.

  40. CVE-2026-82100 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

  41. CVE-2026-82099 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  42. CVE-2026-82098 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  43. CVE-2026-82097 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability.

  44. CVE-2026-82095 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  45. CVE-2026-82092 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

  46. CVE-2026-81554 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

  47. CVE-2026-81551 8.1 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability.

  48. CVE-2026-81550 8.8 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

  49. CVE-2026-81540 8.5 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability.

  50. CVE-2026-81210 7.7 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match.

  51. CVE-2026-81207 8.5 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an outbound fetch originating from a shared-infrastructure pod, and the WSDL body is reflected verbatim to the caller. The ds-canvas pod sits on the OpenShift overlay with reach to co-tenant services, in-cluster CP4D APIs, and link-local addresses. Scope is Changed, confidentiality High (response-reflecting), integrity Low (GET-only side-effects).

  52. CVE-2026-80436 8.5 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization.

  53. CVE-2026-80434 5.0 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference.

  54. CVE-2026-80424 9.1 Critique

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.

  55. CVE-2026-80380 7.1 Élevée

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery.

  56. CVE-2026-80378 6.5 Moyenne

    IBM DataStage on Cloud Pak for Data

    IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization.

  57. CVE-2026-14350 5.3 Moyenne

    IBM Cloud Pak for Data System

    IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

  58. CVE-2026-3686 6.2 Moyenne

    IBM Cloud Pak for Data System

    IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources.