DeutschShown in its original language — a full translation is planned for a future version.
IBM App Connect Enterprise: Mehrere Schwachstellen
view advisory published 2026-07-22
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-12947US | — | — | ||
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user. | ||||
| CVE-2026-54288US | —OT elevated | — | ||
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, the Body Limit Middleware trusts the request's Content-Length header to deci… | ||||
| CVE-2026-54290US | — | — | ||
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CO… | ||||
| CVE-2026-54289US | — | — | ||
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda@Edge, CloudFront delivers a request header that appears more t… | ||||
| CVE-2026-54287US | — | — | ||
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on AWS Lambda, the ALB single-header response and the VPC Lattice v2 respons… | ||||
| CVE-2026-54286US | — | — | ||
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows hosts, an encoded backslash (%5C) in the request path decodes to… | ||||
| CVE-2026-54269US | — | — | ||
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properti… | ||||
| CVE-2026-53655US | medium5.5 | — | ||
node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any… | ||||
| CVE-2026-5038US | high7.5 | — | ||
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orp… | ||||
| CVE-2026-5079US | — | — | ||
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependenc… | ||||
| CVE-2026-53606US | — | — | ||
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Versions of sanitize-html prior to 2.17.5 us… | ||||
| CVE-2026-12143US | — | — | ||
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concate… | ||||
| CVE-2026-42338US | medium6.1 | — | ||
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-contro… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-35841 vom 2026-08-01external
- Red Hat Security Advisory RHSA-2026:52399 vom 2026-08-10external
- WID-SEC-W-2026-2488 - CSAF Versionself
- WID-SEC-2026-2488 - Portal Versionself
- IBM Security Bulletin 7280891 vom 2026-07-22external
- IBM Security Bulletin 7280894 vom 2026-07-22external
- IBM Security Bulletin 7280896 vom 2026-07-22external
- IBM Security Bulletin 7280899 vom 2026-07-22external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan