Security Bulletin: IBM Event Endpoint Management is vulnerable to unauthorized access

Summary IBM Event Endpoint Management is vulnerable to unauthorized access due to improper restriction of hidden directories CVE-2025-11965 Vulnerability Details CVEID:CVE-2025-11965 DESCRIPTION: In Eclipse Vert.x versions 4.0.0, 4.5.21 and 5.0.0, 5.0.4, a StaticHandler configuration for...

CVE-2025-11966

In Eclipse Vert.x versions 4.0.0, 4.5.21 and 5.0.0, 5.0.4, when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path...

ai.tock:bot-test (19.9.0), ai.tock:bot-test-base (19.9.0) +106 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.8.1)

io.vertx:vertx-web MAVEN version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - ai.tock:bot-test 19.9.0 - ai.tock:bot-test-base 19.9.0 - ai.tock:bot-toolkit 19.9.0 - ai.tock:bot-toolkit-base 19.9.0 -...

ai.tock:bot-test (>=25.9.0, <=25.10.6), ai.tock:bot-test-base (>=25.9.0, <=25.10.6) +95 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (>=5.0.0, <=5.0.4)

io.vertx:vertx-web MAVEN version =5.0.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.10.6 and more Source cves: CVE-2025-11966 Source advisory: GHSA-45P5-V273-3QQR...

ai.tock:bot-test (20.9.3), ai.tock:bot-test-base (20.9.3) +1336 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.9.5)

io.vertx:vertx-web MAVEN version 3.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - ai.tock:bot-test 20.9.3 - ai.tock:bot-test-base 20.9.3 - ai.tock:bot-toolkit 20.9.3 - ai.tock:bot-toolkit-base 20.9.3 -...

ai.tock:bot-test (>=19.9.3, <=19.9.4), ai.tock:bot-test-base (>=19.9.3, <=19.9.4) +506 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.8.5)

io.vertx:vertx-web MAVEN version 3.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - ai.tock:bot-test =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3, =19.9.3...

io.reinert.requestor.ext:requestor-vertx (1.4.0), io.vertx:vertx-health-check (3.9.10) +8 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.9.10)

io.vertx:vertx-web MAVEN version 3.9.10 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.reinert.requestor.ext:requestor-vertx 1.4.0 - io.vertx:vertx-health-check 3.9.10 - io.vertx:vertx-shell 3.9.10 -...

be.fluid-it.reactive-microservice.bundle:bootique-vertx (0.1-8), be.fluid-it.reactive-microservice.bundle:reactive-microservice-bundle-core (0.1-8) +232 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.5.0)

io.vertx:vertx-web MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - be.fluid-it.reactive-microservice.bundle:bootique-vertx 0.1-8 -...

ai.tock:bot-test (19.9.2), ai.tock:bot-test-base (19.9.2) +256 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.8.4)

io.vertx:vertx-web MAVEN version 3.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - ai.tock:bot-test 19.9.2 - ai.tock:bot-test-base 19.9.2 - ai.tock:bot-toolkit 19.9.2 - ai.tock:bot-toolkit-base 19.9.2 -...

cc.vileda.kalfor:kalfor-combine-handler (1.2.1), cc.vileda.kalfor:kalfor-handler (2.0.0) +16 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.3.0)

io.vertx:vertx-web MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - cc.vileda.kalfor:kalfor-combine-handler 1.2.1 - cc.vileda.kalfor:kalfor-handler 2.0.0 - cc.vileda.kalfor:kalfor-library 1.2...

com.exonum.binding:exonum-java-binding-core (>=0.1.1, <=0.2), com.github.riteshkukreja:vertx-annotations (1.0.0) +94 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.5.2)

io.vertx:vertx-web MAVEN version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - com.exonum.binding:exonum-java-binding-core =0.1.1, =2.0.1, =2.0.1, =2.0.1, =1.6.3, =1.6.3, =1.6.3, =1.6.3, =0.1.1, =0.1.1,...

io.github.crabzilla:crabzilla-example1-service (0.0.5), io.github.crabzilla:crabzilla-kotlin-example1-service (0.0.5) +15 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.5.0.beta1)

io.vertx:vertx-web MAVEN version 3.5.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.github.crabzilla:crabzilla-example1-service 0.0.5 - io.github.crabzilla:crabzilla-kotlin-example1-service 0.0.5 -...

com.github.fmcejudo:quarkus-eureka (0.0.5), com.github.fmcejudo:quarkus-eureka-deployment (0.0.5) +125 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.8.3-01)

io.vertx:vertx-web MAVEN version 3.8.3-01 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - com.github.fmcejudo:quarkus-eureka 0.0.5 - com.github.fmcejudo:quarkus-eureka-deployment 0.0.5 -...

com.github.kakulisen:java-chassis-core (1.0.0), com.github.timofeevda.jstressy:jstressy-api (>=1.0.11, <=1.0.12) +211 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.6.2)

io.vertx:vertx-web MAVEN version 3.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - com.github.kakulisen:java-chassis-core 1.0.0 - com.github.timofeevda.jstressy:jstressy-api =1.0.11, =1.0.11, =1.0.11,...

com.github.advantageous:qbit-admin (>=0.9.1-rc11, <=0.9.2-rc14), com.github.advantageous:qbit-consul-client (>=0.9.1-rc11, <=0.9.2-rc14) +42 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.1.0)

io.vertx:vertx-web MAVEN version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - com.github.advantageous:qbit-admin =0.9.1-rc11, =0.9.1-rc11, =0.9.1-rc11, =0.9.1-rc11, =0.9.1-rc11, =0.9.1-rc11, =0.9.1-rc1...

ai.konduit.serving:konduit-serving-api (>=0.0.2, <=0.1.0), ai.konduit.serving:konduit-serving-cli (>=0.0.2, <=0.1.0) +416 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.9.1)

io.vertx:vertx-web MAVEN version 3.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - ai.konduit.serving:konduit-serving-api =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =0.0.2, =20.3.2,...

io.vertx:vertx-stack-depchain (3.0.0-milestone6), io.vertx:vertx-stack-dist (3.0.0-milestone6) +1 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.0.0-milestone6)

io.vertx:vertx-web MAVEN version 3.0.0-milestone6 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.vertx:vertx-stack-depchain 3.0.0-milestone6 - io.vertx:vertx-stack-dist 3.0.0-milestone6 -...

com.checkmarx:cx-client-common (>=2023.2.2, <=2023.4.1), com.checkmarx:cx-ws-fs-agent (>=23.0.1, <=23.0.4) +14 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.9.15)

io.vertx:vertx-web MAVEN version 3.9.15 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - com.checkmarx:cx-client-common =2023.2.2, =23.0.1, =3.1.2.rc1, =3.1.2.rc1, =3.1.2.rc1, =1.3.0, =1.4.0 and more Source cves...

com.github.erosb:openapi-operation-vertx (>=2.0.0-rc1, <=2.0.0-rc4), com.github.liuzhengyang:apm-agent (>=1.1, <=1.5) +172 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.8.3)

io.vertx:vertx-web MAVEN version 3.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - com.github.erosb:openapi-operation-vertx =2.0.0-rc1, =1.1, =1.1, =1.1, =1.0, =14.0.10, =0.0.7, =0.0.9 -...

io.vertx:vertx-circuit-breaker-scala_2.12 (3.5.3.cr1), io.vertx:vertx-dropwizard-metrics-scala_2.12 (3.5.3.cr1) +24 more potentially affected by CVE-2025-11966 via io.vertx:vertx-web (3.5.3.cr1)

io.vertx:vertx-web MAVEN version 3.5.3.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-web and may be impacted: - io.vertx:vertx-circuit-breaker-scala2.12 3.5.3.cr1 - io.vertx:vertx-dropwizard-metrics-scala2.12 3.5.3.cr1 -...