Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway Desktop Edition.

Summary Multiple vulnerabilities have been found in CICS Transaction Gateway Desktop Edition due to the use of Apache Tomcat Embed, Spring Web MVC, Spring Boot, Spring Core, Spring Context, SnakeYAML, Spring Beans, Logback Classic and Logback Core. The Apache Tomcat Embed, Spring Web MVC, Spring...

Security Bulletin: Vulnerabilities in Spring Context affect IBM SPSS Collaboration and Deployment Services (CVE-2025-22233, CVE-2024-38820)

Summary Vulnerabilities in Spring Context affect IBM SPSS Collaboration and Deployment Services CVE-2025-22233, CVE-2024-38820. These have been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowercase...

Security Bulletin: IBM Operational Decision Manager for Oct 2025 - Multiple CVEs addressed

Summary IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-22233...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in the Spring framework (CVE-2025-22233)

Summary A vulnerability in the Spring framework that is used by IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for reques...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.

Summary Multiple vulnerabilities were addressed in IBM Business Automation Manager Open Editions 9.2.1. Vulnerability Details CVEID:CVE-2025-22150 DESCRIPTION: Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses Math.random to choos...

Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-context-6.2.3.jar (CVE-2025-22233)

Summary IBM Sterling Connect:Direct Web Services uses spring-context-6.2.3.jar, which has vulnerability CVE-2025-22233. This has been addressed in fixpacks that are available on Fix Central. Vulnerability Details CVEID:CVE-2025-22233 DESCRIPTION: CVE-2024-38820 ensured Locale-independent, lowerca...

Spring_framework 5.3.x < 5.3.43 / 6.0.x < 6.0.28 / 6.1.x < 6.1.20 / 6.2.x < 6.2.7 (CVE-2025-22233)

The version of Springframework installed on the remote host is prior to 5.3.43, 6.0.28, 6.1.20, or 6.2.7. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22233 advisory. - CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.2.0), ai.ancf.lmos-router:lmos-router-llm-spring-boot-starter (0.2.0) +10626 more potentially affected by CVE-2024-38820 +1 more via org.springframework:spring-context (>=6.2.0, <=6.2.6)

org.springframework:spring-context MAVEN version =6.2.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.29 and more Source cves: CVE-2024-38820, CVE-2025-22233 Source advisory: GHSA-4WP7-92PW-Q264...

am.ik.home:uaa-client (>=1.0.0, <=1.2.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.2.0) +844 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.5.release)

org.springframework:spring-context MAVEN version 4.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - am.ik.home:uaa-client =1.0.0, =1.0.0, =1.0.0, =0.0.25, =1.3.1, =0.0.25, =0.0.25,...

cn.jairdavis:jair-common-utils (1.0.4), com.aerse:gcless (11.2) +172 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.0.2.release)

org.springframework:spring-context MAVEN version 4.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - cn.jairdavis:jair-common-utils 1.0.4 - com.aerse:gcless 11.2 -...

ch.ralscha:extdirectspring (1.7.3), cn.afterturn:easypoi-spring-boot-starter (>=0.1, <=0.1.1) +1941 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.12.release)

org.springframework:spring-context MAVEN version 4.3.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ch.ralscha:extdirectspring 1.7.3 - cn.afterturn:easypoi-spring-boot-starter =0.1,...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.cedarsoftware:json-command-servlet (>=1.0.0, <=1.1.2) +178 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (3.2.6.release)

org.springframework:spring-context MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +1607 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.10.release)

org.springframework:spring-context MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

be.eliwan:ew-profiling-api (>=1.0, <=1.4), be.eliwan:ew-profiling-core (>=1.0, <=1.4) +1259 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (3.0.5.release)

org.springframework:spring-context MAVEN version 3.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - be.eliwan:ew-profiling-api =1.0, =1.0, =2.0-beta1, =1.1.1, =1.0.2, =1.1.2, =1.2,...

am.ik.blog:blog-domain (>=4.0.2, <=4.2.0), am.ik.blog:blog-mapper (>=4.0.0, <=4.4.0) +1739 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.7.release)

org.springframework:spring-context MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - am.ik.blog:blog-domain =4.0.2, =4.0.0, =2.0.0, =1.0.3, =1.0.0, =2.4, =2.4, =2.4,...

ar.com.fdvs:dynamicjasper (>=5.0.9, <=5.1.0), br.com.caelum.stella:caelum-stella-boleto (>=2.1.7, <=2.2.2) +837 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (3.0.6.release)

org.springframework:spring-context MAVEN version 3.0.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ar.com.fdvs:dynamicjasper =5.0.9, =2.1.7, =20.3.0, =20.3.0, =2.23.5, =2.23.5,...

cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +178 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (3.2.0.release)

org.springframework:spring-context MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =0.4.0, =0.0.1, =0.0.1, =0.0.1, =0.0....

ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone (>=0.7, <=0.8), ch.rasc:sse-eventbus (1.1.6) +1661 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.14.release)

org.springframework:spring-context MAVEN version 4.3.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ch.codeblock.qrinvoice.rest:qrinvoice-rest-standalone =0.7, =0.1.6-v1, =1.0.0 -...

ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.10, <=0.1.12), ai.houyi:dorado (>=0.0.6, <=0.0.8) +1469 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.18.release)

org.springframework:spring-context MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ai.foremast.metrics:foremast-spring-boot-15x-starter =0.1.10, =0.0.6, =0.0.11,...

ch.rasc:sse-eventbus (1.1.9), com.atlassian.oai:swagger-request-validator-examples (>=2.9.1, <=2.13.0) +481 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (4.3.26.release)

org.springframework:spring-context MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ch.rasc:sse-eventbus 1.1.9 - com.atlassian.oai:swagger-request-validator-examples...