Datastage On Cloud Pak For Data
Monthly
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
XML external entity (XXE) injection in the PxXMLInput operator of IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker submit crafted XML so that the job's XML parser resolves external entities, exposing host files and internal network resources. The flaw is confidentiality-only (CVSS 7.7, C:H/I:N/A:N) and requires valid credentials plus a job that feeds attacker-influenced XML into the PxXMLInput stage. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
Cross-site request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated users, with high integrity impact. Exploitation requires social engineering to lure a logged-in DataStage user to a malicious page, at which point the victim's browser silently submits forged requests to the DataStage application. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant - regardless of project membership or assigned role - to weaponize the shared ds-canvas pod as a network proxy by fully controlling the scheme, host, port, and path of outbound WSDL fetches it performs. The pod's position on the OpenShift overlay network grants reach to co-tenant services, in-cluster CP4D APIs, and link-local IMDS-style addresses, and the fetched body is reflected verbatim to the caller, enabling cross-tenant data exfiltration and internal service reconnaissance. No public exploit or KEV listing has been identified at time of analysis; vendor patch is available.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Cross-tenant path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a low-privileged authenticated attacker to overwrite ruleset files owned by other tenants on the same platform instance. The flaw (CWE-22) exploits insufficient path sanitization in a multi-tenant context, enabling one tenant's user to corrupt another tenant's data integration rule definitions. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory at ibm.com/support/pages/node/7286562.
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user to inject and execute arbitrary OS commands on the underlying host. The CWE-78 flaw stems from insufficient sanitization of user-controlled input before it is passed to a system shell call, and the CVSS 8.8 vector (PR:L) confirms exploitation does not require administrative privileges - any valid account suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the IBM support portal.
Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arbitrarily write to or delete files on the platform's shared storage layer. The flaw (CWE-22) allows user-controlled input to escape intended directory boundaries via sequences such as '../', bypassing storage isolation within the shared Cloud Pak for Data environment. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (PR:L/AV:N/AC:L) confirms that any low-privilege authenticated user can exploit this without special conditions or user interaction, achieving full confidentiality, integrity, and availability compromise. IBM has released a patch via advisory 7286562, and no public exploit has been identified at time of analysis.
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible low-privileged user to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any authenticated DataStage account - including data engineers or analysts, not just administrators - can trigger full confidentiality, integrity, and availability compromise of the affected component. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands, achieving full compromise of the affected system. The CVSS 8.8 score (AV:N/AC:L/PR:L) reflects low-complexity network exploitation gated only by a valid low-privilege credential, with complete confidentiality, integrity, and availability impact on the DataStage host. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) attacker to read sensitive information and bypass security restrictions, crossing a privilege/scope boundary within the Cloud Pak for Data platform. The scope-changed CVSS 9.6 reflects that a low-privileged foothold can reach data and controls outside the attacker's authorized boundary; there is no availability impact. IBM has released a patch, but no public exploit has been identified and no EPSS or KEV signal is present in the provided data.
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the user-defined function component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the job subroutine component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system. [CVSS 6.5 MEDIUM]
Datastage On Cloud Pak For Data is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used to impersonate other users in the system. [CVSS 8.1 HIGH]
A path traversal flaw (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user manipulate file paths to read, write, or delete arbitrary files on the host. The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N), reflecting high confidentiality and integrity impact with no availability impact, so valid credentials are a prerequisite. Publicly available exploit code has been referenced, but CISA KEV does not list this CVE and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' - meaning it is a serious post-authentication primitive rather than a broadly observed in-the-wild campaign at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
XML external entity (XXE) injection in the PxXMLInput operator of IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker submit crafted XML so that the job's XML parser resolves external entities, exposing host files and internal network resources. The flaw is confidentiality-only (CVSS 7.7, C:H/I:N/A:N) and requires valid credentials plus a job that feeds attacker-influenced XML into the PxXMLInput stage. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 can be made to execute arbitrary code by an authenticated remote user because the XSLT transformation engine is misconfigured in a way that lets attacker-supplied transformations reach code-execution paths. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, C/I/A all High), meaning any holder of valid low-privilege DataStage credentials can potentially obtain full control of the affected service. IBM has published a patch, and there is no public exploit code or CISA KEV listing associated with this CVE at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary operating-system commands with the privileges of the DataStage service account (CVSS 8.8, CWE-78). The flaw requires valid credentials (PR:L) but no user interaction, and successful exploitation yields complete loss of confidentiality, integrity and availability on the affected host or container. IBM has published a vendor patch; there is no CISA KEV entry, no confirmed public exploit code, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', which lowers but does not eliminate real-world urgency for exposed deployments.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special characters in the PxPeek name property, allowing an authenticated remote user to inject and execute arbitrary operating-system commands on the DataStage engine. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), reflecting full loss of confidentiality, integrity, and availability for a low-privileged authenticated attacker. A vendor patch is available from IBM, no public exploit code or CISA KEV entry was identified at time of analysis, and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, making it a patch-promptly rather than drop-everything priority.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
Cross-site request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated users, with high integrity impact. Exploitation requires social engineering to lure a logged-in DataStage user to a malicious page, at which point the victim's browser silently submits forged requests to the DataStage application. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write files to unintended locations by supplying a crafted archive whose entries escape the intended extraction directory. The path-traversal flaw (CWE-22) occurs during archive extraction and carries a CVSS 9.1 rating driven by a scope change and high integrity impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant - regardless of project membership or assigned role - to weaponize the shared ds-canvas pod as a network proxy by fully controlling the scheme, host, port, and path of outbound WSDL fetches it performs. The pod's position on the OpenShift overlay network grants reach to co-tenant services, in-cluster CP4D APIs, and link-local IMDS-style addresses, and the fetched body is reflected verbatim to the caller, enabling cross-tenant data exfiltration and internal service reconnaissance. No public exploit or KEV listing has been identified at time of analysis; vendor patch is available.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Cross-tenant path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a low-privileged authenticated attacker to overwrite ruleset files owned by other tenants on the same platform instance. The flaw (CWE-22) exploits insufficient path sanitization in a multi-tenant context, enabling one tenant's user to corrupt another tenant's data integration rule definitions. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory at ibm.com/support/pages/node/7286562.
Remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 permits any network-accessible authenticated user to inject and execute arbitrary OS commands on the underlying host. The CWE-78 flaw stems from insufficient sanitization of user-controlled input before it is passed to a system shell call, and the CVSS 8.8 vector (PR:L) confirms exploitation does not require administrative privileges - any valid account suffices. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the IBM support portal.
Path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables any remote authenticated low-privilege user to arbitrarily write to or delete files on the platform's shared storage layer. The flaw (CWE-22) allows user-controlled input to escape intended directory boundaries via sequences such as '../', bypassing storage isolation within the shared Cloud Pak for Data environment. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (PR:L/AV:N/AC:L) confirms that any low-privilege authenticated user can exploit this without special conditions or user interaction, achieving full confidentiality, integrity, and availability compromise. IBM has released a patch via advisory 7286562, and no public exploit has been identified at time of analysis.
Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.
Remote authenticated OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables a network-accessible low-privileged user to execute arbitrary operating system commands on the underlying host. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that any authenticated DataStage account - including data engineers or analysts, not just administrators - can trigger full confidentiality, integrity, and availability compromise of the affected component. A vendor patch is available; no public exploit or CISA KEV listing has been identified at time of analysis.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 enables remote authenticated attackers to execute arbitrary operating system commands, achieving full compromise of the affected system. The CVSS 8.8 score (AV:N/AC:L/PR:L) reflects low-complexity network exploitation gated only by a valid low-privilege credential, with complete confidentiality, integrity, and availability impact on the DataStage host. IBM has released a patch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) attacker to read sensitive information and bypass security restrictions, crossing a privilege/scope boundary within the Cloud Pak for Data platform. The scope-changed CVSS 9.6 reflects that a low-privileged foothold can reach data and controls outside the attacker's authorized boundary; there is no availability impact. IBM has released a patch, but no public exploit has been identified and no EPSS or KEV signal is present in the provided data.
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the user-defined function component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the job subroutine component. [CVSS 6.3 MEDIUM]
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system. [CVSS 6.5 MEDIUM]
Datastage On Cloud Pak For Data is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used to impersonate other users in the system. [CVSS 8.1 HIGH]