Skip to content
OpenAdvisories
High WID-SEC-2025-2154 7 CVEs

IBM InfoSphere Information Server: Mehrere Schwachstellen

Published Sep 29, 2025 · Updated Sep 29, 2025 · de-DE

Vendor: IBM Product: InfoSphere Information Server Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

IBM InfoSphere Information Server ist eine Softwareplattform zur Integration heterogener Daten.

Vulnerabilities 7

  • High 8.8
    CVE-2025-36245

    IBM InfoSphere Information Server command execution

    IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

    IBM InfoSphere Information Server
  • High 7.5
    CVE-2024-28168

    Apache XML Graphics FOP: XML External Entity (XXE) Processing

    Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

    Apache Software Foundation Apache XML Graphics FOP fop fop Debian Ubuntu Maven
  • Medium 5.8
    CVE-2025-53864

    Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

    Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the G…

    Connect2id Nimbus JOSE+JWT druid tez Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2025-31672

    Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

    Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (inc…

    Apache Software Foundation Apache POI opensearch-2 libapache-poi-java Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2025-50181

    urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

    urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are …

    urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 5.3
    CVE-2025-50182

    urllib3 does not control redirects in browsers and Node.js

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling…

    urllib3 urllib3 katib-earlystopping kubeflow-pipelines-apiserver Debian Wolfi PyPI
  • Unscored —
    CVE-2010-2245

    XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary file…

Revision history

  1. #1

    Initiale Fassung

References