C2Bridge

C2Bridges позволяют разработчикам создавать новые пользовательские протоколы связи и быстро использовать их в Covenant. C2Bridges C2Bridges используются для разработки исходящего протокола управления и контроля без редактирования кода Covenant. Для разработчиков, которые чувствуют себя комфортно...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip through 2.0.1 only checks the parent directory of each archive entry, allowing a symlink-then-regular-file pair with identical names to write through the planted symlink and achieve arbitrary file write outside the destination directory. CVSS: 8.1 High, CWE-22. Vulnerability...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip 2.0.1 does not validate symlink targets during zip extraction, allowing a malicious archive with relative symlink paths to read or write arbitrary files outside the extraction directory. CVSS: 8.1 High, CWE-22. Vulnerability Details CVEID:CVE-2026-56876 DESCRIPTION: extract-zi...

Security Bulletin: DEV-EXT - spring-webmvc-6.2.19.jar (Publicly disclosed vulnerability found by Scanner)

Summary IBM Db2 Developer Extension is affected by 3 Spring MVC CVEs in spring-webmvc-6.2.19.jar: CVE-2026-47884 — CVSS 9.8 , CVE-2026-47887 — CVSS 6.1 , CVE-2026-47890 — CVSS 9.8 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSR...

Security Bulletin: nanoid-3.3.18.tgz (Publicly disclosed vulnerability found by Scanner)

Summary nanoid before 5.1.6/5.1.16 has infinite loops in customAlphabet/customRandom/nanoid non-secure when passed a size of 0 or negative value, hanging the calling thread and causing DoS. CVSS: 5.9 Medium, CWE-835. Vulnerability Details CVEID:CVE-2026-67213 DESCRIPTION: nanoid Nano ID before...

Security Bulletin: dompurify-3.4.12.tgz (Publicly disclosed vulnerability found by Scanner)

Summary DOMPurify before 3.4.13 has an XSS vulnerability in INPLACE sanitization — element-removal hooks fail to neutralize detached subtrees, allowing event handlers on descendant elements to execute after sanitization completes. CVSS: 5.1 Medium, CWE-79. Vulnerability Details...

Security Bulletin: jackson-databind-2.21.2.jar

Summary IBM Db2 Developer Extension uses jackson-databind, which is vulnerable to multiple security issues including polymorphic type validator bypass CVE-2026-54512, CVE-2026-54513, server-side request forgery via DNS resolution CVE-2026-54514, improper @JsonIgnore enforcement CVE-2026-54515,...

Security Bulletin: IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core (CVE-2026-41848)

Summary IBM DB2 Developer Extension is affected due to vulnerability in Spring boot Core CVE-2026-41848 Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS attack if an attacker is able to provide a pattern which i...

Security Bulletin: Vulnerability in @opentelemetry/core affects DB2 Dev Extension (CVE-2026-54285)

Summary Upgraded @opentelemetry/core to 2.8.0. Vulnerability Details CVEID:CVE-2026-54285 DESCRIPTION: opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP header...

Security Bulletin: Vulnerability in Apache Log4j API affects DB2 Dev Extension (CVE-2026-49844)

Summary Upgraded log4j-api to 2.25.5 to remediate CVE-2026-49844 CWE-116: Improper Encoding of non-finite floating-point values in MapMessage JSON serialization — CVSS Base Score 6.3 Medium — PVR0815934. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: brace-expansion-2.1.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary brace-expansion 2.1.1 affected by CVE-2026-13149 — exponential CPU consumption in expand via consecutive non-expanding brace groups, causing event-loop blocking DoS. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 is vulnerable to denial of service...

Security Bulletin: Vulnerability in Spring Boot affects DB2 Dev Extension (CVE-2026-40992, CVE-2026-41001)

Summary Upgraded spring-boot-autoconfigure to 3.5.15 to remediate CVE-2026-40992 Improper Certificate Validation and CVE-2026-41001 Insecure Temporary File — highest CVSS Base Score 5.3 Medium — PVR0789890. Vulnerability Details CVEID:CVE-2026-40992 DESCRIPTION: Spring Boot's Mail...

Security Bulletin: Vulnerability in brace-expansion affects DB2 Dev Extension (CVE-2026-14257)

Summary Upgraded brace-expansion to 5.0.8 to remediate CVE-2026-14257 CWE-400: Uncontrolled Resource Consumption — memory exhaustion DoS via unbounded result string length in expand — CVSS Base Score 7.5 High — PVR0827522. Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion...

Security Bulletin: Vulnerability in form-data affects DB2 Dev Extension (CVE-2026-12143)

Summary Upgraded form-data to 4.0.6 to remediate CVE-2026-12143 CWE-93: CRLF Injection — CVSS Base Score 7.5 High — PVR0791412. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in Spring Expression (CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 )

Summary IBM Db2 Developer Extension is affected by vulnerability in Spring Expression CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

Security Bulletin: Vulnerability in Apache Tomcat affects DB2 Dev Extension (CVE-2026-59083, CVE-2026-59084)

Summary Upgraded tomcat-embed-core to 10.1.57 to remediate CVE-2026-59083 Security Constraint Bypass via URL hex-encoding and CVE-2026-59084 Insufficient EncryptInterceptor Documentation — CVSS Base Score 9.1 Critical — PVR0818163. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41293, CVE-2026-43512, CVE-2026-43513, CVE-2026-43515 Vulnerability Details CVEID:CVE-2026-41293 DESCRIPTION: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat:...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in log4j core (CVE-2026-34477, CVE-2026-34478)

Summary IBM Db2 Developer Extension is affected by vulnerability in log4j core CVE-2026-34477, CVE-2026-34478 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificatio...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in axios (CVE-2025-62718)

Summary IBM Db2 Developer Extension is affected by vulnerability in axios CVE-2025-62718 Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization whe...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41284,CVE-2026-42498,CVE-2026-43514,CVE-2026-24880, CVE-2026-34483,CVE-2026-34487,CVE-2026-34500)

Summary IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core CVE-2026-41284,CVE-2026-42498,CVE-2026-43514,CVE-2026-24880, CVE-2026-34483,CVE-2026-34487,CVE-2026-34500 Vulnerability Details CVEID:CVE-2026-41284 DESCRIPTION: Allocation of Resources Without Limits or...