DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
IBM App Connect Enterprise: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-04-21
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, und um einen Denial of Service Angriff durchzuführen.
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-33228US | critical9.8 | — | ||
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys… | ||||
| CVE-2026-33036US | — | — | ||
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where nume… | ||||
| CVE-2026-32141US | — | — | ||
flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a craf… | ||||
| CVE-2026-31988US | — | — | ||
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function.… | ||||
| CVE-2026-31802US | medium5.5 | Exploit | ||
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive… | ||||
| CVE-2026-29786US | medium6.3 | Exploit | ||
node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-rela… | ||||
| CVE-2026-30827US | — | — | ||
express-rate-limit is a basic rate-limiting middleware for Express. In versions starting from 8.0.0 and prior to versions 8.0.2, 8.1.1, 8.2.2, and 8.3.0, the default keyGenerator i… | ||||
| CVE-2026-27601US | medium5.9 | — | ||
Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions,… | ||||
| CVE-2026-27904US | — | — | ||
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4… | ||||
| CVE-2026-27903US | — | — | ||
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3… | ||||
| CVE-2026-26278US | — | — | ||
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, th… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WID-SEC-W-2026-1220 - CSAF Versionself
- WID-SEC-2026-1220 - Portal Versionself
- IBM Security Bulletin 7270309 vom 2026-04-21external
- IBM Security Bulletin 7271910 vom 2026-05-06external
- IBM Security Bulletin 7273772 vom 2026-05-22external
- IBM Security Bulletin 7274683 vom 2026-06-01external
- IBM Security Bulletin 7275269 vom 2026-06-05external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan