18645 matches found
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Summary The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted fo...
GHSA-XGM2-5F3F-MVVC Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
Summary The AWS API Gateway v1 adapter can drop a distinct repeated request header value. When a header appears multiple times, the adapter de-duplicates values using a substring comparison instead of an exact match, so a value that is a substring of another value of the same header is omitted fo...
Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-11143)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Jetty. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing ...
Security Bulletin: Security Vulnerability in logback-core affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-1225)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to logback-core Vulnerability Details CVEID:CVE-2026-1225 DESCRIPTION: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java...
Security Bulletin: Security Vulnerability in Netty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-67735)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Netty Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the...
Security Bulletin: XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-36431)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability. Vulnerability Details CVEID:CVE-2025-36431 DESCRIPTION: IBM Sterling File Gateway is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip...
Security Bulletin: Security Vulnerability in Spring Boot affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22731 CVE-2026-22733)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring Boot Vulnerability Details CVEID:CVE-2026-22731 DESCRIPTION: Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoi...
Security Bulletin: Security Vulnerability in Spring affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-22737)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring. Vulnerability Details CVEID:CVE-2026-22737 DESCRIPTION: Use of Java scripting engine enabled e.g. JRuby, Jython template views in Spring MVC and Spring WebFlux applications can result in...
Plane contains multi-tenant authorization bypass vulnerability
Overview The project management tool Plane, versions 1.3.0 and earlier, contains a multi-tenant authorization bypass vulnerability in its asset-management API that allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces. Description Plane is an open-source...
PT-2026-62614
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Integrated SOA Gateway versions 12.2.3 through 12.2.15 Description A flaw in the Web Service Provider component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...
PT-2026-63157
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle EDI Gateway versions 12.2.3 through 12.2.15 Description A flaw in the EDI component of the Oracle EDI Gateway allows a low privileged attacker with network access via HTTP to compromise the system. This can lead ...
Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-0540)
Summary DOMPurify is used by the UI component of IBM DataPower Gateway Vulnerability Details CVEID:CVE-2026-0540 DESCRIPTION: DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute...
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel
Summary The following CVEs in the OS kernel may affect IBM DataPower Gateway Vulnerability Details CVEID:CVE-2024-26984 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel agains...
CVE-2026-12972
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders...
EUVD-2026-45887
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...
CVE-2026-12973
The CVE describes a vulnerability in the PayPlus Payment Gateway WordPress plugin prior to 8.2.2 where an unauthenticated user-accessible AJAX action does not perform authorization or order-ownership validation. This allows disclosure of the secret order key for arbitrary WooCommerce orders and, ...
CVE-2026-12973 PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...
EUVD-2026-45780
In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.numrequests The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places announcement was received, backbone is purged, periodic work...
