Skip to content
OpenAdvisories
Medium WID-SEC-2025-2909 4 CVEs

IBM App Connect Enterprise: Mehrere Schwachstellen

Published Dec 22, 2025 · Updated Apr 7, 2026 · Revision 3 · de-DE

Vendor: IBM Product: App Connect Enterprise Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 4

  • High 7.5
    CVE-2025-64756

    glob CLI: Command injection via -c/--cmd executes matches with shell:true

    Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files …

    isaacs node-glob renovate prism Alpine Wolfi npm
  • High 7.5
    CVE-2025-65945 Public exploit

    auth0/node-jws improper HMAC signature verification vulnerability

    auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

    auth0 node-jws langfuse-3-worker renovate Wolfi npm
  • Medium 5.5
    CVE-2025-13466

    body-parser vulnerable to denial of service when url encoding is used

    body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing…

    body-parser body-parser saf code-server Debian Ubuntu Wolfi npm
  • Medium 5.3
    CVE-2025-64718

    js-yaml has prototype pollution in merge (<<)

    js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documen…

    nodeca js-yaml katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Neue Updates von IBM aufgenommen

  3. #1

    Initiale Fassung

References