Skip to content
OpenAdvisories
Medium WID-SEC-2026-0881 4 CVEs

IBM License Metric Tool: Mehrere Schwachstellen

Published Mar 25, 2026 · Updated Mar 26, 2026 · Revision 2 · de-DE

Vendor: Debian Vendor: IBM Product: License Metric Tool Product: Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um Informationen offenzulegen, einen Cross Site Scripting Angriff durchzuführen oder einen Denial of Service zu verursachen.

Product

Das IBM License Metric Tool dient der Lizenzverwaltung für IBM Produkte.

Vulnerabilities 4

  • High 7.5
    CVE-2026-22860

    Rack has a Directory Traversal via Rack:Directory

    Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path star…

    rack rack logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2026-25639

    Axios affected by Denial of Service via __proto__ Key in mergeConfig

    Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can tr…

    axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2025-68161

    Apache Log4j Core: Missing TLS hostname verification in Socket appender

    The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

    Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  • Medium 5.4
    CVE-2026-25500

    Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

    Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javas…

    rack rack logstash-9.3 logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi RubyGems

Revision history

  1. #2

    Neue Updates von Debian aufgenommen

  2. #1

    Initiale Fassung

References