IBM DataStage vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains improper neutralization of special characters in the PxPeek name property. A remote authenticated attacker could exploit this to execute arbitrary OS commands.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to OS command injection. A remote authenticated attacker could exploit this to execute arbitrary commands.

The PxXMLInput operator in IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to XML external entity (XXE) injection. A remote authenticated attacker could exploit this to obtain sensitive information.

IBM DataStage on Cloud Pak for Data 5.4.0.0 has an improper configuration of the XSLT transformation engine. A remote authenticated attacker could exploit this to execute arbitrary code.

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability. A remote authenticated attacker could exploit this to read, write, or delete arbitrary files.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.