Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.7.0. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cau...

The vulnerability of D-Link DIR-859 router’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of D-Link DIR-859 router microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2025-19902 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.6 Description: The issue concerns authentication and authorization attacks due to incorrect validation processing in IBM i Netserver. A malicious actor could exploit these weaknesses, in conjunction with brute for...

The Hidden Risks of LLM-Generated Web Application Code: a Security-Centric Evaluation of Code Generation Capabilities in Large Language Models

The rapid advancement of Large Language Models LLMs has enhanced software development processes, minimizing the time and effort required for coding and enhancing developer productivity. However, despite their potential benefits, code generated by LLMs has been shown to generate insecure code in...

The vulnerability of the software for integrating Emarsys functions into Android mobile applications lies in its authentication mechanism’s flaws. This allows a hacker to redirect users to any desired URL address.

The vulnerability of the software for integrating Emarsys functions into Android mobile applications is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a hacker to redirect users to any desired URL address...

The vulnerability of the RFC Enabled Function Module component in software integration platforms such as SAP NetWeaver and ABAP Platform arises from deficiencies in authentication procedures, allowing unauthorized access to protected information.

The vulnerability of the RFC Enabled Function Module in software integration platforms such as SAP NetWeaver and ABAP Platform is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing

GraphQL is an open-source data query and manipulation language for web applications, offering a flexible alternative to RESTful APIs. However, its dynamic execution model and lack of built-in security mechanisms expose it to vulnerabilities such as unauthorized data access, denial-of-service DoS...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in their authentication procedures’ flaws, which allow attackers to execute arbitrary code.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the deficiencies of the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

The vulnerability of the Industrial Edge Device Kit’s software for data collection, processing, and analysis is related to deficiencies in authentication procedures, allowing attackers to circumvent security restrictions.

The vulnerability of the Industrial Edge Device Kit’s software for data collection, processing, and analysis is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions remotely...

The vulnerability of the web interface of the cross-platform FTP server CrushFTP allows a hacker to gain unauthorized access to the software.

The vulnerability of the cross-platform FTP server CrushFTP lies in the deficiencies of its authentication process. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to the software by sending a specially crafted HTTP request...

The vulnerability of the TLS 1.3 implementation in NGINX Plus and NGINX Open Source web servers allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the TLS 1.3 implementation in NGINX Plus and NGINX Open Source web servers is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2025-30118

An issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to denial of service. It uses the same default credentials for all devices and does not implement proper multi-device authentication, allowing attackers to deny the owner access by occupying the only...

The vulnerability in the WebChannel API interface of Mozilla Firefox, Firefox ESR, and email clients Thunderbird, Thunderbird ESR, allows a perpetrator to escalate their privileges.

The vulnerability of the WebChannel API interface in browsers such as Mozilla Firefox, Firefox ESR, and email clients like Thunderbird, Thunderbird ESR, is related to authentication process flaws. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

The vulnerability of LLM-powered system startups like AnythingLLM, related to shortcomings in authentication procedures, allows attackers to gain unauthorized access to protected information.

The vulnerability of the LLM startup and management system, AnythingLLM, is related to deficiencies in the authentication process when processing the id parameter. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the web interface of the Aruba Networks ClearPass Policy Manager allows a perpetrator to execute arbitrary commands.

The vulnerability of the Aruba Networks ClearPass Policy Manager’s web interface is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

The vulnerability of Remote Desktop Services (RDS) for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of Remote Desktop Services RDS for Windows operating systems is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server lies in its authentication procedures’ flaws, which allow attackers to escalate their privileges, gain unauthorized access to protected information, or cause service failures.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to enhance their privileges, gain unauthorized access to protected information, or cause service failures...

The vulnerability of software solutions that support the closing, consolidation, and reporting processes of IBM Cognos Controller and IBM Controller lies in the lack of authentication procedures. This allows attackers to bypass security restrictions and gain access to read and modify data.

The vulnerabilities of the software solutions that support the closing, consolidation, and reporting processes of IBM Cognos Controller and IBM Controller are related to deficiencies in the authentication process. Exploiting these vulnerabilities can allow an attacker to bypass security...

The vulnerability of the CIE.AspNetCore.Authentication library in the ASP.NET Core software platform arises from authentication procedures that have flaws. This allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the CIE.AspNetCore.Authentication library in the ASP.NET Core software platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass security restrictions and gain unauthorized access to protected informatio...

The vulnerability of the business analytics application IBM Cognos Analytics Mobile client allows a attacker to perform a “Man-in-the-Middle” attack.

The vulnerability of the IBM Cognos Mobile Client application for business analytics involves errors in the authentication process. Exploiting this vulnerability can allow an attacker to carry out a “Man-in-the-Middle” attack remotely...