DataStage on Cloud Pak for Data vulnerabilities
47 known vulnerabilities in DataStage on Cloud Pak for Data from IBM. 47 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
DataStage on Cloud Pak for Data: Absolute Path Traversal
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
- 7.7 High severity
DataStage on Cloud Pak for Data: Server-Side Request Forgery
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.
- 10.0 Critical severity
DataStage on Cloud Pak for Data: Improper Authorization
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cac
- 7.4 High severity
DataStage on Cloud Pak for Data: Improper Certificate Validation
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token
- 9.9 Critical severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Control of Generation of Code
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 9.6 Critical severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.
- 7.1 High severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
- 8.8 High severity
DataStage on Cloud Pak for Data: Deserialization of Untrusted Data
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.
- 7.7 High severity
DataStage on Cloud Pak for Data: Server-Side Request Forgery
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 7.7 High severity
DataStage on Cloud Pak for Data: Improper Restriction of XML External Entity Reference
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.
- 7.7 High severity
DataStage on Cloud Pak for Data: Insufficiently Protected Credentials
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or envi
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 9.9 Critical severity
DataStage on Cloud Pak for Data: Improper Authorization
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Control of Generation of Code
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.
- 8.8 High severity
DataStage on Cloud Pak for Data: External Control of File Name or Path
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability.
- 9.6 Critical severity
DataStage on Cloud Pak for Data: Improper Authentication
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- 8.8 High severity
DataStage on Cloud Pak for Data: Server-Side Request Forgery
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 8.1 High severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability.
- 8.8 High severity
DataStage on Cloud Pak for Data: Improper Neutralization of Special Elements used in an OS Command
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- 8.5 High severity
DataStage on Cloud Pak for Data: Improper Limitation of a Pathname to a Restricted Directory
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability.
- 7.7 High severity
DataStage on Cloud Pak for Data: Authorization Bypass Through User-Controlled Key
IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/e
- 8.5 High severity
DataStage on Cloud Pak for Data: Server-Side Request Forgery
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an outbound fetch originating from a shared-infrastructure pod, and the WSDL body is reflected verbatim t