DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM Rational Team Concert: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-10-27
Ein Angreifer kann mehrere Schwachstellen in IBM Rational Team Concert ausnutzen, um einen Denial-of-Service-Angriff durchzuführen, Eingaben oder Protokolle zu manipulieren, die Authentifizierung zu umgehen, beliebigen Code auszuführen, Cross-Site-Scripting durchzuführen, sensible Informationen offenzulegen oder offene Weiterleitungen auszulösen.
01
beschreibt (15)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-36085US | — | — | ||
IBM Concert 1.0.0 through 2.0.0 Software is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system… | ||||
| CVE-2025-36083US | medium5.5 | — | ||
IBM Concert Software
1.0.0 through 2.0.0 could allow a local user to obtain sensitive information from buffers due to improper clearing of heap memory before release. | ||||
| CVE-2025-36081US | — | — | ||
IBM Concert Software
1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input. | ||||
| CVE-2025-9288US | critical9.1 | — | ||
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. | ||||
| CVE-2025-45768US | —OT erhöht | — | ||
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedl… | ||||
| CVE-2025-7783US | —OT erhöht | Exploit | ||
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.
This is… | ||||
| CVE-2025-7338US | — | Exploit | ||
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to… | ||||
| CVE-2025-53547US | high8.6 | Exploit | ||
Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execu… | ||||
| CVE-2025-50182US | medium6.1 | — | ||
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 support… | ||||
| CVE-2025-50181US | medium6.1 | — | ||
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retrie… | ||||
| CVE-2025-22874US | — | — | ||
Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy gra… | ||||
| CVE-2025-48060US | high7.5 | Exploit | ||
jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function `jv_string_vfmt` in the jq_fuzz_execute harness from oss-f… | ||||
| CVE-2024-23337US | medium6.5 | — | ||
jq is a command-line JSON processor. In versions up to and including 1.7.1, an integer overflow arises when assigning value using an index of 2147483647, the signed integer limit.… | ||||
| CVE-2025-32379US | medium6.1 | — | ||
Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it,… | ||||
| CVE-2024-33531US | — | — | ||
cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan