Security Bulletin: The IBM® Engineering Lifecycle Management products using WebSphere Application Server could provide weaker than expected security due to crypto.js (CVE-2020-36732)

Summary A vulnerability in crypto.js library affects IBM WebSphere Application Server Liberty with the openidConnectServer-1.0 feature enabled. Following IBM® Engineering Lifecycle Management products are vulnerable to this attack, and addressed in this bulletin: Global Configuration Management,...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2025-53864...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2023-52428...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2023-52428...

org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2023-52428...

com.cybersource:authenticationsdk (>=0.0.1, <=0.0.5), com.cybersource:cybersource-rest-client-java (>=0.0.1, <=0.0.12) +7 more potentially affected by CVE-2023-1370 via net.minidev:json-smart (1.0.9)

net.minidev:json-smart MAVEN version 1.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on net.minidev:json-smart and may be impacted: - com.cybersource:authenticationsdk =0.0.1, =0.0.1, =1.0.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.1, =0.3 Source cves:...

Security Bulletin: Liberty for Java for IBM Cloud is vulnerable to a denial of service (CVE-2020-4590)

Summary There is a denial of service vulnerablility in IBM WebSphere Application Server Liberty used in Liberty for Java for IBM Cloud. Vulnerability Details CVEID:CVE-2020-4590 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2017-12973...

org.mitre:openid-connect-client (>=0.9.0, <=0.9.1), org.mitre:openid-connect-common (>=0.9.0, <=0.9.1) +2 more potentially affected by CVE-2017-12973 via com.nimbusds:nimbus-jose-jwt (2.13.0)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.1 Source cves: CVE-2017-12973...

org.mitre:openid-connect-client (>=0.9.2, <=1.0.0), org.mitre:openid-connect-common (>=0.9.2, <=1.0.0) +2 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.13.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =0.9.2, =0.9.2, =0.9.2, =0.9.2, =1.0.0 Source cves: CVE-2017-12972...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2017-12974 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2017-12974...

org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

org.mitre:openid-connect-client (>=1.0.1, <=1.0.11), org.mitre:openid-connect-common (>=1.0.1, <=1.0.11) +2 more potentially affected by CVE-2017-12972 via com.nimbusds:nimbus-jose-jwt (2.15.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.1, =1.0.1, =1.0.1, =1.0.1, =1.0.11 Source cves: CVE-2017-12972...

Autobinding vulnerability in MITREid Connect

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment aka Autobinding vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in...

net.simpledynamics:openid-connect-server-spring-boot-config (>=0.1.0, <=0.1.3), net.simpledynamics:openid-connect-server-spring-boot-samples-default (>=0.1.0, <=0.1.1) +7 more potentially affected by CVE-2021-26715 via org.mitre:openid-connect-server (>=1.1.0, <=1.3.3)

org.mitre:openid-connect-server MAVEN version =1.1.0, =0.1.0, =0.1.0, =0.1.0, =0.11, =1.1.0, =1.2.0-rc1, =1.2.0-rc1, =1.3.3 Source cves: CVE-2021-26715 Source advisory: GHSA-792R-MH2Q-P8QP...

GHSA-792R-MH2Q-P8QP Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery SSRF vulnerability. The vulnerability arises due to unsafe usage of the logouri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP reque...

com.github.avarabyeu.jashing.extensions:jashing-cvs (>=0.0.9, <=0.0.16), com.github.avarabyeu.jashing.extensions:jashing-git (>=0.0.9, <=0.0.16) +11 more potentially affected by CVE-2021-23369 via org.webjars:handlebars (3.0.3)

org.webjars:handlebars MAVEN version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:handlebars and may be impacted: - com.github.avarabyeu.jashing.extensions:jashing-cvs =0.0.9, =0.0.9, =0.0.9, =0.0.12, =0.0.9, =0.0.9, =0.4.1, =1.7.9...