Skip to content
OpenAdvisories
Medium WID-SEC-2025-1409 2 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Manipulation von Daten

Published Jun 26, 2025 · Updated Jun 26, 2025 · de-DE

Vendor: IBM Product: App Connect Enterprise Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Daten zu manipulieren.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 2

  • Critical 9.1
    CVE-2025-6545

    pbkdf2 silently returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos supported by Node.js

    Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.

    pbkdf2 node-pbkdf2 node-pbkdf2 Debian Ubuntu npm
  • Critical 9.1
    CVE-2025-6547

    On Node.js < 3, pbkdf2 silently disregards Uint8Array input, returning static keys

    Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

    pbkdf2 npm

Revision history

  1. #1

    Initiale Fassung

References