Skip to content
OpenAdvisories
Medium WID-SEC-2025-0998 7 CVEs

IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

Published May 11, 2025 · Updated Aug 6, 2025 · Revision 3 · de-DE

Vendor: IBM Product: App Connect Enterprise Product: Business Automation Workflow Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 7

  • High 7.7
    CVE-2025-27152 Public exploit

    Possible SSRF and Credential Leakage via Absolute URL in axios Requests

    axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

    axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2024-6827

    HTTP Request Smuggling in benoitc/gunicorn

    Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerabili…

    benoitc benoitc/gunicorn emissary emissary-apiext Debian Ubuntu Wolfi PyPI
  • Medium 6.2
    CVE-2025-27789

    Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups

    Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic comp…

    babel babel katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  • Medium 5.1
    CVE-2025-1993

    IBM App Connect Enterprise Certified Container information disclosure

    IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, 12.8, 12.9, and 12.10 DesignerAuthoring instances store their flows in a database tha…

    IBM App Connect Enterprise Certified Container
  • Medium 4.3
    CVE-2025-1194

    Regular Expression Denial of Service (ReDoS) in huggingface/transformers

    A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTo…

    Hugging Face huggingface/transformers transformers PyPI
  • Medium 4.0
    CVE-2025-32996

    http-proxy-middleware can call writeBody twice because "else if" is not used

    In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

    chimurai http-proxy-middleware katib-suggestion-hyperopt katib-earlystopping Wolfi npm
  • Medium 4.0
    CVE-2025-32997

    http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed

    In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

    chimurai http-proxy-middleware katib-suggestion-hyperopt katib-earlystopping Wolfi npm

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Neue Updates von IBM aufgenommen

  3. #1

    Initiale Fassung

References