Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to bypassing security restrictions [CVE-2024-47764]

Summary Node.js module cookie is used by IBM App Connect Enterprise Certified Container for parsing HTTP cookies. IBM App Connect Enterprise Certified Container operands are vulnerable to security restrictions bypass. This bulletin provides patch information to address the reported vulnerability ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to backtracking due to path-to-regexp (CVE-2024-52798)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor and IBM App Connect Enterprise Discovery Connectors are vulnerable to backtracking due to path-to-regexp. Vulnerability Details CVEID:CVE-2024-52798 DESCRIPTION: path-to-regexp turns path strings into a regular expressions...

Security Bulletin: IBM App Connect Enterprise is vulnerable to non-integer values mishandles due to nanoid (CVE-2024-55565)

Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Runtime are vulnerable to non-integer value mishandles due to nanoid. Vulnerability Details CVEID:CVE-2024-55565 DESCRIPTION: nanoid aka Nano I...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the account linking logic. An attacker can anticipate and use the email address of a user to register a public frontend user account before the user's first OIDC login, leading to...

GHSA-HJ78-P4H7-M5FV TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

Problem Description A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met: - An attacker can anticipate the email address of the user. - An attacker can regist...

TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

Problem Description A vulnerability in the account linking logic of the extension allows a pre-hijacking attack leading to Account Takeover. The attack can only be exploited if the following requirements are met: - An attacker can anticipate the email address of the user. - An attacker can regist...

PT-2025-8868

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue has been identified in the Linux kernel, specifically in the vsock subsystem. This issue arises when a socket is unbound during a transport reassignment, leading t...

TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-001...

PT-2025-8788

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version that includes the fix for the mptcp fastopen disconnect issue Description A vulnerability in the Linux kernel's mptcp protocol has been identified, where the handling of disconnect generated internall...

MAL-2025-550 Malicious code in meli-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 51bcf8ede43a6fd8fa810529ae2d62e97197165ba94b7d41c8b58e3607d39551 The OpenSSF Package Analysis project identified 'meli-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in meli-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 51bcf8ede43a6fd8fa810529ae2d62e97197165ba94b7d41c8b58e3607d39551 The OpenSSF Package Analysis project identified 'meli-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-528 Malicious code in lyft-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 315320431749982def4c72ea78c96ab88faead336d157234851073d549dd50b5 The OpenSSF Package Analysis project identified 'lyft-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in lyft-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 315320431749982def4c72ea78c96ab88faead336d157234851073d549dd50b5 The OpenSSF Package Analysis project identified 'lyft-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-490 Malicious code in iberia-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 955b26e00ecd6ed2d59e40af04de984e2e14a38fef862c06b173b38387bea3af The OpenSSF Package Analysis project identified 'iberia-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in iberia-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 955b26e00ecd6ed2d59e40af04de984e2e14a38fef862c06b173b38387bea3af The OpenSSF Package Analysis project identified 'iberia-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-479 Malicious code in google-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b73909cac81405458f9e1a50331aa80aed75bf630379f2eebdb3d06801457d56 The OpenSSF Package Analysis project identified 'google-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in google-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b73909cac81405458f9e1a50331aa80aed75bf630379f2eebdb3d06801457d56 The OpenSSF Package Analysis project identified 'google-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-435 Malicious code in dropbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afdb751e57da5540b343e220fab07e5aa40ad53e4bf33fbadb1e8f53d8469261 The OpenSSF Package Analysis project identified 'dropbox-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in dropbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afdb751e57da5540b343e220fab07e5aa40ad53e4bf33fbadb1e8f53d8469261 The OpenSSF Package Analysis project identified 'dropbox-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in coinbase-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 710b36fc278e57d50e7ce86d489ae5e2da89f2ac58f80653232e0b2f7283e451 The OpenSSF Package Analysis project identified 'coinbase-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...