Medium WID-SEC-2025-2853 14 CVEs

HCL Commerce: Mehrere Schwachstellen

Published Dec 15, 2025 · Updated Dec 15, 2025 · de-DE

Vendor: HCL Software Product: Commerce Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in HCL Commerce ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Informationen offenzulegen.

Product

Commerce ist eine e-Commerce Anwendung von HCL.

Vulnerabilities 14

High 8.2

CVE-2025-55163 Public exploit

Netty MadeYouReset HTTP/2 DDoS Vulnerability

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …

netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Aug 13, 2025
High 7.5

CVE-2025-48976 Public exploit EPSS 34%

Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven

Jun 16, 2025
High 7.5

CVE-2025-48989

Apache Tomcat: h2 DoS - Made You Reset

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older,…

Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Aug 13, 2025
High 7.5

CVE-2025-53066

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Oct 21, 2025
Medium 6.9

CVE-2025-58057

Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below,…

netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Sep 3, 2025
Medium 6.0

CVE-2025-7962

Jakarta Mail vulnerable to SMTP Injection

In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

Eclipse Foundation Jakarta Mail thingsboard-tb-node apache-nifi Debian Ubuntu Wolfi Maven

Jul 21, 2025
Medium 5.9

CVE-2025-36124

IBM WebSphere Application Server Liberty bypass security

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration

IBM WebSphere Application Server - Liberty

Aug 12, 2025
Medium 5.9

CVE-2025-53057

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Oct 21, 2025
Medium 5.3

CVE-2020-36732

crypto-js uses insecure random numbers

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

crypto-js cryptojs Debian npm

Jun 12, 2023
Medium 5.3

CVE-2025-33142

IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.

IBM WebSphere Application Server

Aug 14, 2025
Medium 5.3

CVE-2025-36047

IBM WebSphere Application Server Liberty denial of service

IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

IBM WebSphere Application Server - Liberty

Aug 14, 2025
Medium 5.3

CVE-2025-64718

js-yaml has prototype pollution in merge (<<)

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documen…

nodeca js-yaml katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm

Nov 13, 2025
Medium 4.8

CVE-2025-30754

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jul 15, 2025
Medium 4.4

CVE-2025-36000

IBM WebSphere Application Server Liberty cross-site scripting

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially …

IBM WebSphere Application Server - Liberty

Aug 12, 2025

Revision history

2025-12-15 #1
Initiale Fassung

References

HCL Security Bulletin vom 2025-12-15
https://support.hcl-software.com/community?id=community_blog&sys_id=ba0a1cde33b5ba10159a05273e5c7bbd
HCL Security Bulletin vom 2025-12-15
https://support.hcl-software.com/community?id=community_blog&sys_id=942bd81633f5ba10159a05273e5c7b06