{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below.\n\nSiemens has released a new version of SIDIS Prime and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
      },
      {
        "category": "self",
        "summary": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-485750.json"
      }
    ],
    "title": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800",
    "tracking": {
      "current_release_date": "2026-03-10T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-485750",
      "initial_release_date": "2026-03-10T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-03-10T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c4.0.800",
                "product": {
                  "name": "SIDIS Prime",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SIDIS Prime"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-29857",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-29857"
    },
    {
      "cve": "CVE-2024-30171",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-30171"
    },
    {
      "cve": "CVE-2024-30172",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-30172"
    },
    {
      "cve": "CVE-2024-41996",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-41996"
    },
    {
      "cve": "CVE-2025-6965",
      "cwe": {
        "id": "CWE-197",
        "name": "Numeric Truncation Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-6965"
    },
    {
      "cve": "CVE-2025-7783",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\r\n\r\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-7783"
    },
    {
      "cve": "CVE-2025-9230",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9230"
    },
    {
      "cve": "CVE-2025-9232",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the \u0027no_proxy\u0027 environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na \u0027no_proxy\u0027 environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9232"
    },
    {
      "cve": "CVE-2025-9670",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9670"
    },
    {
      "cve": "CVE-2025-12816",
      "cwe": {
        "id": "CWE-436",
        "name": "Interpretation Conflict"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-12816"
    },
    {
      "cve": "CVE-2025-15284",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummaryThe arrayLimit\u00a0option in qs does not enforce limits for bracket notation (a[]=1\u0026a[]=2), allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit\u00a0for DoS protection are vulnerable.\n\nDetailsThe arrayLimit\u00a0option only checks limits for indexed notation (a[0]=1\u0026a[1]=2) but completely bypasses it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code\u00a0(lib/parse.js:159-162):\n\nif (root === \u0027[]\u0027 \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code\u00a0(lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf)\u00a0without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit\u00a0before creating arrays.\n\nPoCTest 1 - Basic bypass:\n\nnpm install qs\n\n\n\n\n\nconst qs = require(\u0027qs\u0027);\nconst result = qs.parse(\u0027a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6\u0027, { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nTest 2 - DoS demonstration:\n\nconst qs = require(\u0027qs\u0027);\nconst attack = \u0027a[]=\u0027 + Array(10000).fill(\u0027x\u0027).join(\u0027\u0026a[]=\u0027);\nconst result = qs.parse(attack, { arrayLimit: 100 });\nconsole.log(result.a.length);  // Output: 10000 (should be max 100)\n\n\n\n\n\nConfiguration:\n\n  *  arrayLimit: 5\u00a0(test 1) or arrayLimit: 100\u00a0(test 2)\n  *  Use bracket notation: a[]=value\u00a0(not indexed a[0]=value)\n\n\nImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()\u00a0with user-controlled input and arrayLimit\u00a0for protection.\n\nAttack scenario:\n\n  *  Attacker sends HTTP request: GET /api/search?filters[]=x\u0026filters[]=x\u0026...\u0026filters[]=x\u00a0(100,000+ times)\n  *  Application parses with qs.parse(query, { arrayLimit: 100 })\n  *  qs ignores limit, parses all 100,000 elements into array\n  *  Server memory exhausted \u2192 application crashes or becomes unresponsive\n  *  Service unavailable for all users\nReal-world impact:\n\n  *  Single malicious request can crash server\n  *  No authentication required\n  *  Easy to automate and scale\n  *  Affects any endpoint parsing query strings with bracket notation",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-58751",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58751"
    },
    {
      "cve": "CVE-2025-58752",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: \u0027spa\u0027` (default) or `appType: \u0027mpa\u0027` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58752"
    },
    {
      "cve": "CVE-2025-58754",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: \u0027stream\u0027`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58754"
    },
    {
      "cve": "CVE-2025-62522",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-62522"
    },
    {
      "cve": "CVE-2025-64718",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it\u0027s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-64718"
    },
    {
      "cve": "CVE-2025-64756",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c \u003ccommand\u003e \u003cpatterns\u003e are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-64756"
    },
    {
      "cve": "CVE-2025-66030",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66030"
    },
    {
      "cve": "CVE-2025-66031",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66031"
    },
    {
      "cve": "CVE-2025-66035",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular\u0027s HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66035"
    },
    {
      "cve": "CVE-2025-66412",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler\u0027s internal security schema is incomplete, allowing attackers to bypass Angular\u0027s built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66412"
    },
    {
      "cve": "CVE-2025-69277",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "notes": [
        {
          "category": "summary",
          "text": "libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0027t in the main cryptographic group.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-69277"
    },
    {
      "cve": "CVE-2026-22610",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular\u2019s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG \u003cscript\u003e elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2026-22610"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs18",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs18 fixes the following issues:\n\n  - CVE-2025-7783: Switched away from Math.random() in boundary values for multipart form-encoded data (bsc#1246818)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2025-3919,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-3919",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_3919-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2025:3919-1",
        "url": "https://www.suse.com/support/update/announcement/2025/suse-su-20253919-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2025:3919-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023140.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246818",
        "url": "https://bugzilla.suse.com/1246818"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-7783 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-7783/"
      }
    ],
    "title": "Security update for nodejs18",
    "tracking": {
      "current_release_date": "2025-11-03T10:32:00Z",
      "generator": {
        "date": "2025-11-03T10:32:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2025:3919-1",
      "initial_release_date": "2025-11-03T10:32:00Z",
      "revision_history": [
        {
          "date": "2025-11-03T10:32:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "corepack18-18.20.8-8.41.1.aarch64",
                "product": {
                  "name": "corepack18-18.20.8-8.41.1.aarch64",
                  "product_id": "corepack18-18.20.8-8.41.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-18.20.8-8.41.1.aarch64",
                "product": {
                  "name": "nodejs18-18.20.8-8.41.1.aarch64",
                  "product_id": "nodejs18-18.20.8-8.41.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-devel-18.20.8-8.41.1.aarch64",
                "product": {
                  "name": "nodejs18-devel-18.20.8-8.41.1.aarch64",
                  "product_id": "nodejs18-devel-18.20.8-8.41.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "npm18-18.20.8-8.41.1.aarch64",
                "product": {
                  "name": "npm18-18.20.8-8.41.1.aarch64",
                  "product_id": "npm18-18.20.8-8.41.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "corepack18-18.20.8-8.41.1.i586",
                "product": {
                  "name": "corepack18-18.20.8-8.41.1.i586",
                  "product_id": "corepack18-18.20.8-8.41.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-18.20.8-8.41.1.i586",
                "product": {
                  "name": "nodejs18-18.20.8-8.41.1.i586",
                  "product_id": "nodejs18-18.20.8-8.41.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-devel-18.20.8-8.41.1.i586",
                "product": {
                  "name": "nodejs18-devel-18.20.8-8.41.1.i586",
                  "product_id": "nodejs18-devel-18.20.8-8.41.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "npm18-18.20.8-8.41.1.i586",
                "product": {
                  "name": "npm18-18.20.8-8.41.1.i586",
                  "product_id": "npm18-18.20.8-8.41.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs18-docs-18.20.8-8.41.1.noarch",
                "product": {
                  "name": "nodejs18-docs-18.20.8-8.41.1.noarch",
                  "product_id": "nodejs18-docs-18.20.8-8.41.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "corepack18-18.20.8-8.41.1.ppc64le",
                "product": {
                  "name": "corepack18-18.20.8-8.41.1.ppc64le",
                  "product_id": "corepack18-18.20.8-8.41.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-18.20.8-8.41.1.ppc64le",
                "product": {
                  "name": "nodejs18-18.20.8-8.41.1.ppc64le",
                  "product_id": "nodejs18-18.20.8-8.41.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-devel-18.20.8-8.41.1.ppc64le",
                "product": {
                  "name": "nodejs18-devel-18.20.8-8.41.1.ppc64le",
                  "product_id": "nodejs18-devel-18.20.8-8.41.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "npm18-18.20.8-8.41.1.ppc64le",
                "product": {
                  "name": "npm18-18.20.8-8.41.1.ppc64le",
                  "product_id": "npm18-18.20.8-8.41.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "corepack18-18.20.8-8.41.1.s390x",
                "product": {
                  "name": "corepack18-18.20.8-8.41.1.s390x",
                  "product_id": "corepack18-18.20.8-8.41.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-18.20.8-8.41.1.s390x",
                "product": {
                  "name": "nodejs18-18.20.8-8.41.1.s390x",
                  "product_id": "nodejs18-18.20.8-8.41.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-devel-18.20.8-8.41.1.s390x",
                "product": {
                  "name": "nodejs18-devel-18.20.8-8.41.1.s390x",
                  "product_id": "nodejs18-devel-18.20.8-8.41.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "npm18-18.20.8-8.41.1.s390x",
                "product": {
                  "name": "npm18-18.20.8-8.41.1.s390x",
                  "product_id": "npm18-18.20.8-8.41.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "corepack18-18.20.8-8.41.1.x86_64",
                "product": {
                  "name": "corepack18-18.20.8-8.41.1.x86_64",
                  "product_id": "corepack18-18.20.8-8.41.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-18.20.8-8.41.1.x86_64",
                "product": {
                  "name": "nodejs18-18.20.8-8.41.1.x86_64",
                  "product_id": "nodejs18-18.20.8-8.41.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs18-devel-18.20.8-8.41.1.x86_64",
                "product": {
                  "name": "nodejs18-devel-18.20.8-8.41.1.x86_64",
                  "product_id": "nodejs18-devel-18.20.8-8.41.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm18-18.20.8-8.41.1.x86_64",
                "product": {
                  "name": "npm18-18.20.8-8.41.1.x86_64",
                  "product_id": "npm18-18.20.8-8.41.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs18-18.20.8-8.41.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-18.20.8-8.41.1.x86_64"
        },
        "product_reference": "nodejs18-18.20.8-8.41.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs18-devel-18.20.8-8.41.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-devel-18.20.8-8.41.1.x86_64"
        },
        "product_reference": "nodejs18-devel-18.20.8-8.41.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs18-docs-18.20.8-8.41.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-docs-18.20.8-8.41.1.noarch"
        },
        "product_reference": "nodejs18-docs-18.20.8-8.41.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm18-18.20.8-8.41.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
          "product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:npm18-18.20.8-8.41.1.x86_64"
        },
        "product_reference": "npm18-18.20.8-8.41.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-7783",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-7783"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-18.20.8-8.41.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-devel-18.20.8-8.41.1.x86_64",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-docs-18.20.8-8.41.1.noarch",
          "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:npm18-18.20.8-8.41.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-7783",
          "url": "https://www.suse.com/security/cve/CVE-2025-7783"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246810 for CVE-2025-7783",
          "url": "https://bugzilla.suse.com/1246810"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-18.20.8-8.41.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-devel-18.20.8-8.41.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-docs-18.20.8-8.41.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:npm18-18.20.8-8.41.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-18.20.8-8.41.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-devel-18.20.8-8.41.1.x86_64",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-docs-18.20.8-8.41.1.noarch",
            "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:npm18-18.20.8-8.41.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-11-03T10:32:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-7783"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "BigFix ist eine L\u00f6sung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in HCL BigFix Komponente ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuf\u00fchren, um Daten zu manipulieren, um Informationen offenzulegen, und um einen Cross-Site Scripting Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1854 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1854.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1854 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1854"
      },
      {
        "category": "external",
        "summary": "HCL Security Bulletin KB0123330 vom 2025-08-17",
        "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0123330"
      },
      {
        "category": "external",
        "summary": "HCL Security Advisory vom 2025-10-11",
        "url": "https://support.hcl-software.com/community?id=community_blog\u0026sys_id=7e13ad453becfa94cb0155f726e45a99"
      }
    ],
    "source_lang": "en-US",
    "title": "HCL BigFix Komponente: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-10-12T22:00:00.000+00:00",
      "generator": {
        "date": "2025-10-13T08:50:03.918+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-1854",
      "initial_release_date": "2025-08-17T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-08-17T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-10-12T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von HCL aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "HCL BigFix",
                "product": {
                  "name": "HCL BigFix",
                  "product_id": "T036098",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hcltech:bigfix:webui"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "HCL BigFix",
                "product": {
                  "name": "HCL BigFix",
                  "product_id": "T046294",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hcltech:bigfix:-"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "BigFix"
          }
        ],
        "category": "vendor",
        "name": "HCL"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-3817",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2023-3817"
    },
    {
      "cve": "CVE-2023-5678",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2023-5678"
    },
    {
      "cve": "CVE-2025-52617",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-52617"
    },
    {
      "cve": "CVE-2025-52618",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-52618"
    },
    {
      "cve": "CVE-2025-52619",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-52619"
    },
    {
      "cve": "CVE-2025-52620",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-52620"
    },
    {
      "cve": "CVE-2025-52621",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-52621"
    },
    {
      "cve": "CVE-2025-7338",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-7338"
    },
    {
      "cve": "CVE-2025-7783",
      "product_status": {
        "known_affected": [
          "T046294",
          "T036098"
        ]
      },
      "release_date": "2025-08-17T22:00:00.000+00:00",
      "title": "CVE-2025-7783"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM App Connect Enterprise kombiniert die branchenbew\u00e4hrten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-1929 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1929.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-1929 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1929"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7243409 vom 2025-08-28",
        "url": "https://www.ibm.com/support/pages/node/7243409"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7243688 vom 2025-09-01",
        "url": "https://www.ibm.com/support/pages/node/7243688"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7243690 vom 2025-09-01",
        "url": "https://www.ibm.com/support/pages/node/7243690"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7245979 vom 2025-09-24",
        "url": "https://www.ibm.com/support/pages/node/7245979"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM App Connect Enterprise: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-09-23T22:00:00.000+00:00",
      "generator": {
        "date": "2025-09-24T11:41:52.287+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-1929",
      "initial_release_date": "2025-08-28T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-08-28T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-09-01T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2025-09-23T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "IBM App Connect Enterprise",
                "product": {
                  "name": "IBM App Connect Enterprise",
                  "product_id": "T032495",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.0.12.17",
                "product": {
                  "name": "IBM App Connect Enterprise \u003c12.0.12.17",
                  "product_id": "T046460"
                }
              },
              {
                "category": "product_version",
                "name": "12.0.12.17",
                "product": {
                  "name": "IBM App Connect Enterprise 12.0.12.17",
                  "product_id": "T046460-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:v12__fix_pack_release_12.0.12.17"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c13.0.4.2",
                "product": {
                  "name": "IBM App Connect Enterprise \u003c13.0.4.2",
                  "product_id": "T046621"
                }
              },
              {
                "category": "product_version",
                "name": "13.0.4.2",
                "product": {
                  "name": "IBM App Connect Enterprise 13.0.4.2",
                  "product_id": "T046621-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:13.0.4.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "App Connect Enterprise"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-7338",
      "product_status": {
        "known_affected": [
          "T046460",
          "T046621",
          "T032495"
        ]
      },
      "release_date": "2025-08-28T22:00:00.000+00:00",
      "title": "CVE-2025-7338"
    },
    {
      "cve": "CVE-2025-7339",
      "product_status": {
        "known_affected": [
          "T046460",
          "T046621",
          "T032495"
        ]
      },
      "release_date": "2025-08-28T22:00:00.000+00:00",
      "title": "CVE-2025-7339"
    },
    {
      "cve": "CVE-2025-7783",
      "product_status": {
        "known_affected": [
          "T046460",
          "T046621",
          "T032495"
        ]
      },
      "release_date": "2025-08-28T22:00:00.000+00:00",
      "title": "CVE-2025-7783"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2150 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2150.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2150 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2150"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2025-09-29",
        "url": "https://access.redhat.com/errata/RHSA-2025:16911"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2025-09-29",
        "url": "https://access.redhat.com/errata/RHSA-2025:16916"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2025-09-29",
        "url": "https://access.redhat.com/errata/RHSA-2025:16918"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:18278 vom 2025-10-18",
        "url": "https://access.redhat.com/errata/RHSA-2025:18278"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:18744 vom 2025-10-21",
        "url": "https://access.redhat.com/errata/RHSA-2025:18744"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7249661 vom 2025-10-30",
        "url": "https://www.ibm.com/support/pages/node/7249661"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:19335 vom 2025-10-30",
        "url": "https://access.redhat.com/errata/RHSA-2025:19335"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:19332 vom 2025-11-03",
        "url": "https://access.redhat.com/errata/RHSA-2025:19332"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:20047 vom 2025-11-10",
        "url": "https://access.redhat.com/errata/RHSA-2025:20047"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:21146 vom 2025-11-12",
        "url": "https://access.redhat.com/errata/RHSA-2025:21146"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2025:21704 vom 2025-11-18",
        "url": "https://access.redhat.com/errata/RHSA-2025:21704"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7251934 vom 2025-11-19",
        "url": "https://www.ibm.com/support/pages/node/7251934"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-7976-1 vom 2026-01-27",
        "url": "https://ubuntu.com/security/notices/USN-7976-1"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2737 vom 2026-02-16",
        "url": "https://access.redhat.com/errata/RHSA-2026:2737"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat Enterprise Linux: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2026-02-16T23:00:00.000+00:00",
      "generator": {
        "date": "2026-02-17T09:10:34.099+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2025-2150",
      "initial_release_date": "2025-09-29T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-09-29T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-10-19T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-10-20T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-10-30T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von IBM und Red Hat aufgenommen"
        },
        {
          "date": "2025-11-03T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-11-10T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-11-12T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-11-18T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2025-11-19T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-01-26T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2026-02-16T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "11"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Business Automation Workflow",
            "product": {
              "name": "IBM Business Automation Workflow",
              "product_id": "T043411",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:business_automation_workflow:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM QRadar SIEM",
            "product": {
              "name": "IBM QRadar SIEM",
              "product_id": "T021415",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:qradar_siem:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "RHACS 4.9.0",
                "product": {
                  "name": "Red Hat Enterprise Linux RHACS 4.9.0",
                  "product_id": "T047229",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:rhacs_4.9.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "RHACS 4.7.7",
                "product": {
                  "name": "Red Hat Enterprise Linux RHACS 4.7.7",
                  "product_id": "T047230",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:rhacs_4.7.7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "RHACS 4.8.5",
                "product": {
                  "name": "Red Hat Enterprise Linux RHACS 4.8.5",
                  "product_id": "T047231",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:rhacs_4.8.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Developer Hub \u003c1.8.0",
                "product": {
                  "name": "Red Hat Enterprise Linux Developer Hub \u003c1.8.0",
                  "product_id": "T048395"
                }
              },
              {
                "category": "product_version",
                "name": "Developer Hub 1.8.0",
                "product": {
                  "name": "Red Hat Enterprise Linux Developer Hub 1.8.0",
                  "product_id": "T048395-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:developer_hub__1.8.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-7783",
      "product_status": {
        "known_affected": [
          "T047229",
          "T043411",
          "T048395",
          "67646",
          "T000126",
          "T021415",
          "T047230",
          "T047231"
        ]
      },
      "release_date": "2025-09-29T22:00:00.000+00:00",
      "title": "CVE-2025-7783"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Qlik Sense ist eine Datenanalyse- und Business-Intelligence-Plattform, mit der Benutzer interaktive Dashboards, Visualisierungen und Berichte erstellen k\u00f6nnen, um Erkenntnisse zu gewinnen und datengest\u00fctzte Entscheidungen zu treffen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Qlik Sense ausnutzen, um Sicherheitsvorkehrungen zu umgehen.\r\nUpdate:\r\nNeuen Informationen von Qlik zufolge kann die Schwachstelle in Qlik Sense nicht ausgenutzt werden",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2165 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2165.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2165 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2165"
      },
      {
        "category": "external",
        "summary": "Critical Security Fix vom 2025-09-30",
        "url": "https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2532151"
      },
      {
        "category": "external",
        "summary": "Qlik Security PAtches vom 2025-09-30",
        "url": "https://community.qlik.com/t5/Support-Updates/Qlik-Sense-Enterprise-for-Windows-New-Security-Patches-Available/ba-p/2532152"
      }
    ],
    "source_lang": "en-US",
    "title": "Qlik Sense: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
    "tracking": {
      "current_release_date": "2025-10-05T22:00:00.000+00:00",
      "generator": {
        "date": "2025-10-06T09:20:07.713+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-2165",
      "initial_release_date": "2025-09-30T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-09-30T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-10-05T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Informationen von Qlik aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Enterprise \u003cMay 2025 Patch 6",
                "product": {
                  "name": "Qlik Sense Enterprise \u003cMay 2025 Patch 6",
                  "product_id": "T047299"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise May 2025 Patch 6",
                "product": {
                  "name": "Qlik Sense Enterprise May 2025 Patch 6",
                  "product_id": "T047299-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:qlik:qlik_sense:enterprise__may_2025_patch_6"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise \u003cNovember 2024 Patch 18",
                "product": {
                  "name": "Qlik Sense Enterprise \u003cNovember 2024 Patch 18",
                  "product_id": "T047300"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise November 2024 Patch 18",
                "product": {
                  "name": "Qlik Sense Enterprise November 2024 Patch 18",
                  "product_id": "T047300-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:qlik:qlik_sense:enterprise__november_2024_patch_18"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Enterprise \u003cMay 2024 Patch 24",
                "product": {
                  "name": "Qlik Sense Enterprise \u003cMay 2024 Patch 24",
                  "product_id": "T047301"
                }
              },
              {
                "category": "product_version",
                "name": "Enterprise May 2024 Patch 24",
                "product": {
                  "name": "Qlik Sense Enterprise May 2024 Patch 24",
                  "product_id": "T047301-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:qlik:qlik_sense:enterprise__may_2024_patch_24"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Sense"
          }
        ],
        "category": "vendor",
        "name": "Qlik"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-7783",
      "product_status": {
        "known_affected": [
          "T047299",
          "T047300",
          "T047301"
        ]
      },
      "release_date": "2025-09-30T22:00:00.000+00:00",
      "title": "CVE-2025-7783"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM Rational Team Concert ist ein Kollaborationstool zur Software Entwicklung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM Rational Team Concert ausnutzen, um einen Denial-of-Service-Angriff durchzuf\u00fchren, Eingaben oder Protokolle zu manipulieren, die Authentifizierung zu umgehen, beliebigen Code auszuf\u00fchren, Cross-Site-Scripting durchzuf\u00fchren, sensible Informationen offenzulegen oder offene Weiterleitungen auszul\u00f6sen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2424 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2424.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2424 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2424"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2025-10-27",
        "url": "https://www.ibm.com/support/pages/node/7249356"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM Rational Team Concert: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-10-28T23:00:00.000+00:00",
      "generator": {
        "date": "2025-10-29T07:03:32.478+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-2424",
      "initial_release_date": "2025-10-27T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-10-27T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-10-28T23:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2025-36531, EUVD-2025-36533, EUVD-2025-36532"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.1.0",
                "product": {
                  "name": "IBM Rational Team Concert \u003c2.1.0",
                  "product_id": "T048164"
                }
              },
              {
                "category": "product_version",
                "name": "2.1.0",
                "product": {
                  "name": "IBM Rational Team Concert 2.1.0",
                  "product_id": "T048164-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:rational_team_concert:2.1.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Rational Team Concert"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-23337",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-23337"
    },
    {
      "cve": "CVE-2024-33531",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2024-33531"
    },
    {
      "cve": "CVE-2025-22874",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-22874"
    },
    {
      "cve": "CVE-2025-32379",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-32379"
    },
    {
      "cve": "CVE-2025-36081",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-36081"
    },
    {
      "cve": "CVE-2025-36083",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-36083"
    },
    {
      "cve": "CVE-2025-36085",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-36085"
    },
    {
      "cve": "CVE-2025-45768",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-45768"
    },
    {
      "cve": "CVE-2025-48060",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-48060"
    },
    {
      "cve": "CVE-2025-50181",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-50181"
    },
    {
      "cve": "CVE-2025-50182",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-50182"
    },
    {
      "cve": "CVE-2025-53547",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-53547"
    },
    {
      "cve": "CVE-2025-7338",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-7338"
    },
    {
      "cve": "CVE-2025-7783",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-7783"
    },
    {
      "cve": "CVE-2025-9288",
      "product_status": {
        "known_affected": [
          "T048164"
        ]
      },
      "release_date": "2025-10-27T23:00:00.000+00:00",
      "title": "CVE-2025-9288"
    }
  ]
}