Skip to content
OpenAdvisories
Medium WID-SEC-2025-0474 2 CVEs

IBM Business Automation Workflow: Mehrere Schwachstellen ermöglichen Denial of Service

Published Mar 3, 2025 · Updated Mar 3, 2025 · de-DE

Vendor: IBM Product: Business Automation Workflow Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

IBM Business Automation Workflow ist eine Lösung zur Automatisierung von Arbeitsabläufen.

Vulnerabilities 2

  • High 8.7
    CVE-2024-7254

    Stack overflow in Protocol Buffers Java Lite

    Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsPar…

    Google protobuf-kotlin protobuf-java google-protobuf [JRuby Gem] Debian Ubuntu Wolfi Maven RubyGems
  • Medium 5.3
    CVE-2024-40094 Public exploit

    GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service

    GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

    com.graphql-java:graphql-java Maven

Revision history

  1. #1

    Initiale Fassung

References