Skip to content
OpenAdvisories
High WID-SEC-2025-0841 4 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen

Published Apr 16, 2025 · Updated May 8, 2025 · Revision 2 · de-DE

Vendor: IBM Product: App Connect Enterprise Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen auszuspähen oder seine Privilegien zu eskalieren

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 4

  • Critical 9.3
    CVE-2025-29774 Public exploit

    xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

    xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto …

    node-saml xml-crypto sqlpad sqlpad-compat Wolfi npm
  • Critical 9.3
    CVE-2025-29775 Public exploit EPSS 10%

    xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

    xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto …

    node-saml xml-crypto sqlpad sqlpad-compat Wolfi npm
  • High 7.7
    CVE-2025-27152 Public exploit

    Possible SSRF and Credential Leakage via Absolute URL in axios Requests

    axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

    axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  • None 0.0
    CVE-2024-57965

    In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a p…

    axios axios node-axios node-axios Debian Ubuntu

Revision history

  1. #2

    Neue Updates von IBM aufgenommen

  2. #1

    Initiale Fassung

References