Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to pillarjs Path-to-RegExp (CVE-2024-45296).

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to pillarjs Path-to-RegExp CVE-2024-45296. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-45296 DESCRIPTION: pillarjs Path-to-RegExp is vulnerable to a denial...

Security Bulletin: IBM App Connect Enterprise Certified Container Dashboards that use COS S3 storage are vulnerable to denial of service and security restrictions bypass [CVE-2024-48948] [CVE-2024-48949]

Summary Node.js module elliptic is used by IBM App Connect Enterprise Certified Container for signature validation. IBM App Connect Enterprise Certified Container Dashboard operands that use COS S3 storage are vulnerable to denial of service and security restrictions bypass. This bulletin provide...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to arbitrary code execution [CVE-2024-51465]

Summary IBM App Connect Enterprise Certified Container operator allows arbitrary code execution by an IntegrationRuntime or IntegrationServer due to insufficient checks on the operands configuration. This bulletin provides patch information to address the reported vulnerability in IBM App Connect...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS is vulnerable to a denial of service due to OpenSSL(CVE-2024-6119)

Summary The DataDirect ODBC driver shipped with IBM App Connect Enterprise and IBM Integration Bus for z/OS is vulnerable to a denial of service due to OpenSSL. Vulnerability Details CVEID:CVE-2024-6119 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an error when performing...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to bypassing security restrictions [CVE-2024-47764]

Summary Node.js module cookie is used by IBM App Connect Enterprise Certified Container for parsing HTTP cookies. IBM App Connect Enterprise Certified Container operands are vulnerable to security restrictions bypass. This bulletin provides patch information to address the reported vulnerability ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to non-integer values mishandles due to nanoid (CVE-2024-55565)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Runtime are vulnerable to non-integer value mishandles due to nanoid. Vulnerability Details CVEID:CVE-2024-55565 DESCRIPTION: nanoid aka Nano I...

Security Bulletin: IBM App Connect Enterprise is vulnerable to backtracking due to path-to-regexp (CVE-2024-52798)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor and IBM App Connect Enterprise Discovery Connectors are vulnerable to backtracking due to path-to-regexp. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION: path-to-regexp turns path strings into a regular expressions...

GHSA-HJ78-P4H7-M5FV TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

Problem Description A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met: - An attacker can anticipate the email address of the user. - An attacker can regist...

TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

Problem Description A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met: - An attacker can anticipate the email address of the user. - An attacker can regist...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the account linking logic. An attacker can anticipate and use the email address of a user to register a public frontend user account before the user's first OIDC login, leading to...

TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-001...

MAL-2025-550 Malicious code in meli-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 51bcf8ede43a6fd8fa810529ae2d62e97197165ba94b7d41c8b58e3607d39551 The OpenSSF Package Analysis project identified 'meli-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in meli-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 51bcf8ede43a6fd8fa810529ae2d62e97197165ba94b7d41c8b58e3607d39551 The OpenSSF Package Analysis project identified 'meli-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-528 Malicious code in lyft-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 315320431749982def4c72ea78c96ab88faead336d157234851073d549dd50b5 The OpenSSF Package Analysis project identified 'lyft-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in lyft-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 315320431749982def4c72ea78c96ab88faead336d157234851073d549dd50b5 The OpenSSF Package Analysis project identified 'lyft-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in iberia-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 955b26e00ecd6ed2d59e40af04de984e2e14a38fef862c06b173b38387bea3af The OpenSSF Package Analysis project identified 'iberia-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-490 Malicious code in iberia-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 955b26e00ecd6ed2d59e40af04de984e2e14a38fef862c06b173b38387bea3af The OpenSSF Package Analysis project identified 'iberia-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-479 Malicious code in google-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b73909cac81405458f9e1a50331aa80aed75bf630379f2eebdb3d06801457d56 The OpenSSF Package Analysis project identified 'google-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in google-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b73909cac81405458f9e1a50331aa80aed75bf630379f2eebdb3d06801457d56 The OpenSSF Package Analysis project identified 'google-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in dropbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afdb751e57da5540b343e220fab07e5aa40ad53e4bf33fbadb1e8f53d8469261 The OpenSSF Package Analysis project identified 'dropbox-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...