Skip to content
OpenAdvisories
High WID-SEC-2026-1833 6 CVEs

IBM App Connect Enterprise (basic-ftp, xmldom): Mehrere Schwachstellen

Published Jun 8, 2026 · Updated Jun 15, 2026 · Revision 2 · de-DE

Vendor: HCL Software Vendor: IBM Product: App Connect Enterprise Product: BigFix Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.

Product

IBM App Connect Enterprise kombiniert die branchenbewährten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.

Vulnerabilities 6

  • High 8.7
    CVE-2026-41672

    xmldom: XML node injection through unvalidated comment serialization

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to b…

    xmldom xmldom sqlpad saf Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-41673

    xmldom: Denial of service via uncontrolled recursion in XML serialization

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a …

    xmldom xmldom sqlpad saf Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-41674

    xmldom: XML injection through unvalidated DocumentType serialization

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSu…

    xmldom xmldom sqlpad saf Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-41675

    xmldom: XML node injection through unvalidated processing instruction serialization

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instructi…

    xmldom xmldom sqlpad saf Debian Ubuntu Wolfi npm
  • High 8.6
    CVE-2026-39983 Public exploit

    FTP Command Injection via CRLF in basic-ftp

    basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir…

    patrickjuchli basic-ftp langfuse-3-worker code-server Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-41324

    basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

    basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or …

    patrickjuchli basic-ftp code-server opensearch-dashboards-3-security-dashboards-plugin Debian Ubuntu Wolfi npm

Revision history

  1. #2

    Neue Updates von HCL aufgenommen

  2. #1

    Initiale Fassung

References