Threat database

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

IBM Planning Analytics versions 2.0 and 2.1 contain a stack-based buffer overflow vulnerability that could allow a remote authenticated attacker to execute arbitrary code. This vulnerability has a high severity rating with a CVSS score of 8.1. No official patch or remediation information is provided in the available data.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster.

CVE-2026-90911 is a high-severity vulnerability in IBM Maximo AI Service versions 9.1.0 and 9.2.0. It involves uncontrolled resource consumption that could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a vulnerability involving uncontrolled recursion that can be triggered remotely, leading to a denial of service condition. This flaw does not impact confidentiality or integrity but can cause service unavailability. The vulnerability is identified as CWE-674 and has a CVSS 3.1 score of 7.5, indicating high severity. No patch or remediation details are currently provided, and there are no known exploits in the wild.

IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a critical vulnerability (CVE-2026-90920) involving improper control of code generation, which could allow a remote attacker to execute arbitrary code without authentication.

IBM Maximo AI Service versions 9.1.0 and 9.2.0 contain a vulnerability due to improper handling of malformed frames, which can cause a denial of service by terminating the host process. This issue is identified as CWE-130, involving length parameter inconsistency. The vulnerability has a high severity with a CVSS score of 7.5.

IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 contain a vulnerability due to uncontrolled recursion that can be exploited remotely to cause a denial of service. This vulnerability does not impact confidentiality or integrity but results in service disruption.

IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain an improper access control vulnerability due to a schema-less Custom Resource Definition. This flaw allows improper privilege management, potentially leading to unauthorized access. The vulnerability has a high severity with a CVSS score of 7.2.

IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain an improper access control vulnerability due to a misconfigured Kubernetes NetworkPolicy. This vulnerability allows unintended network egress, potentially exposing sensitive data or services. The issue has a high severity rating with a CVSS score of 7.7, indicating significant confidentiality impact but no integrity or availability impact.

IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a command injection vulnerability due to improper sanitization of user-controlled input passed to a shell command in a Kubernetes operator task. This vulnerability allows an attacker with high privileges to execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 8.7.

IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a vulnerability related to improper input validation. This is due to an unsanitised container image configuration in a Kubernetes operator template, which can lead to code injection. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. There is no information on available patches or vendor advisories specifying remediation. No known exploits are reported in the wild.

IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain a vulnerability due to improper input validation of a container image reference in a Kubernetes operator template. This unsanitized input can lead to code injection issues.

IBM Maximo Application Suite - IoT Component versions 9.0.0, 9.1.0, and 9.2.0 contain a vulnerability that allows a remote attacker to cause a denial of service via an infinite parsing loop when processing certain inputs. This vulnerability is classified as CWE-400, indicating uncontrolled resource consumption. The issue can be exploited without authentication and requires no user interaction.