{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below.\n\nSiemens has released a new version of SIDIS Prime and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
      },
      {
        "category": "self",
        "summary": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-485750.json"
      }
    ],
    "title": "SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800",
    "tracking": {
      "current_release_date": "2026-03-10T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-485750",
      "initial_release_date": "2026-03-10T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-03-10T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003c4.0.800",
                "product": {
                  "name": "SIDIS Prime",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SIDIS Prime"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-29857",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of the curve parameters.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-29857"
    },
    {
      "cve": "CVE-2024-30171",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exception processing.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-30171"
    },
    {
      "cve": "CVE-2024-30172",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-30172"
    },
    {
      "cve": "CVE-2024-41996",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-41996"
    },
    {
      "cve": "CVE-2025-6965",
      "cwe": {
        "id": "CWE-197",
        "name": "Numeric Truncation Error"
      },
      "notes": [
        {
          "category": "summary",
          "text": "There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-6965"
    },
    {
      "cve": "CVE-2025-7783",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\r\n\r\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-7783"
    },
    {
      "cve": "CVE-2025-9230",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9230"
    },
    {
      "cve": "CVE-2025-9232",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the \u0027no_proxy\u0027 environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na \u0027no_proxy\u0027 environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9232"
    },
    {
      "cve": "CVE-2025-9670",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown function of the file src/commonmark-rules.js. Performing manipulation results in inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-9670"
    },
    {
      "cve": "CVE-2025-12816",
      "cwe": {
        "id": "CWE-436",
        "name": "Interpretation Conflict"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-12816"
    },
    {
      "cve": "CVE-2025-15284",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummaryThe arrayLimit\u00a0option in qs does not enforce limits for bracket notation (a[]=1\u0026a[]=2), allowing attackers to cause denial-of-service via memory exhaustion. Applications using arrayLimit\u00a0for DoS protection are vulnerable.\n\nDetailsThe arrayLimit\u00a0option only checks limits for indexed notation (a[0]=1\u0026a[1]=2) but completely bypasses it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code\u00a0(lib/parse.js:159-162):\n\nif (root === \u0027[]\u0027 \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code\u00a0(lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf)\u00a0without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit\u00a0before creating arrays.\n\nPoCTest 1 - Basic bypass:\n\nnpm install qs\n\n\n\n\n\nconst qs = require(\u0027qs\u0027);\nconst result = qs.parse(\u0027a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6\u0027, { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nTest 2 - DoS demonstration:\n\nconst qs = require(\u0027qs\u0027);\nconst attack = \u0027a[]=\u0027 + Array(10000).fill(\u0027x\u0027).join(\u0027\u0026a[]=\u0027);\nconst result = qs.parse(attack, { arrayLimit: 100 });\nconsole.log(result.a.length);  // Output: 10000 (should be max 100)\n\n\n\n\n\nConfiguration:\n\n  *  arrayLimit: 5\u00a0(test 1) or arrayLimit: 100\u00a0(test 2)\n  *  Use bracket notation: a[]=value\u00a0(not indexed a[0]=value)\n\n\nImpactDenial of Service via memory exhaustion. Affects applications using qs.parse()\u00a0with user-controlled input and arrayLimit\u00a0for protection.\n\nAttack scenario:\n\n  *  Attacker sends HTTP request: GET /api/search?filters[]=x\u0026filters[]=x\u0026...\u0026filters[]=x\u00a0(100,000+ times)\n  *  Application parses with qs.parse(query, { arrayLimit: 100 })\n  *  qs ignores limit, parses all 100,000 elements into array\n  *  Server memory exhausted \u2192 application crashes or becomes unresponsive\n  *  Service unavailable for all users\nReal-world impact:\n\n  *  Single malicious request can crash server\n  *  No authentication required\n  *  Easy to automate and scale\n  *  Affects any endpoint parsing query strings with bracket notation",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-58751",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58751"
    },
    {
      "cve": "CVE-2025-58752",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: \u0027spa\u0027` (default) or `appType: \u0027mpa\u0027` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58752"
    },
    {
      "cve": "CVE-2025-58754",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: \u0027stream\u0027`. Versions 0.30.2 and 1.12.0 contain a patch for the issue.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-58754"
    },
    {
      "cve": "CVE-2025-62522",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-62522"
    },
    {
      "cve": "CVE-2025-64718",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it\u0027s possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-64718"
    },
    {
      "cve": "CVE-2025-64756",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c \u003ccommand\u003e \u003cpatterns\u003e are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-64756"
    },
    {
      "cve": "CVE-2025-66030",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66030"
    },
    {
      "cve": "CVE-2025-66031",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66031"
    },
    {
      "cve": "CVE-2025-66035",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular\u0027s HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66035"
    },
    {
      "cve": "CVE-2025-66412",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, and 19.2.17, A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler\u0027s internal security schema is incomplete, allowing attackers to bypass Angular\u0027s built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain javascript: URLs) as requiring strict URL security, enabling the injection of malicious scripts. This vulnerability is fixed in 21.0.2, 20.3.15, and 19.2.17.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-66412"
    },
    {
      "cve": "CVE-2025-69277",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "notes": [
        {
          "category": "summary",
          "text": "libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0027t in the main cryptographic group.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2025-69277"
    },
    {
      "cve": "CVE-2026-22610",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0, a cross-site scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular\u2019s internal sanitization schema fails to recognize the href and xlink:href attributes of SVG \u003cscript\u003e elements as a Resource URL context. This issue has been patched in versions 19.2.18, 20.3.16, 21.0.7, and 21.1.0-rc.0.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.0.800 or later version",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2026-22610"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Developer Hub ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen und Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0105 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0105.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0105 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0105"
      },
      {
        "category": "external",
        "summary": "RedHat Security Advisory vom 2026-01-13",
        "url": "https://access.redhat.com/errata/RHSA-2026:0531"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:0761 vom 2026-01-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:0761"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1730 vom 2026-02-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:1730"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1942 vom 2026-02-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:1942"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-A84E0AD039 vom 2026-02-05",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a84e0ad039"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2147 vom 2026-02-05",
        "url": "https://access.redhat.com/errata/RHSA-2026:2147"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2145 vom 2026-02-05",
        "url": "https://access.redhat.com/errata/RHSA-2026:2145"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2078 vom 2026-02-11",
        "url": "https://access.redhat.com/errata/RHSA-2026:2078"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2456 vom 2026-02-10",
        "url": "https://access.redhat.com/errata/RHSA-2026:2456"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2500 vom 2026-02-11",
        "url": "https://access.redhat.com/errata/RHSA-2026:2500"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2568 vom 2026-02-11",
        "url": "https://access.redhat.com/errata/RHSA-2026:2568"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2762 vom 2026-02-16",
        "url": "https://access.redhat.com/errata/RHSA-2026:2762"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2754 vom 2026-02-16",
        "url": "https://access.redhat.com/errata/RHSA-2026:2754"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2672 vom 2026-02-18",
        "url": "https://access.redhat.com/errata/RHSA-2026:2672"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2926 vom 2026-02-18",
        "url": "https://access.redhat.com/errata/RHSA-2026:2926"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3710 vom 2026-03-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:3710"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3825 vom 2026-03-05",
        "url": "https://access.redhat.com/errata/RHSA-2026:3825"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7266733 vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266733"
      },
      {
        "category": "external",
        "summary": "HCL Security Bulletin",
        "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0130587"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7273312 vom 2026-05-18",
        "url": "https://www.ibm.com/support/pages/node/7273312"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:18480 vom 2026-05-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:18480"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:18868 vom 2026-05-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:18868"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:19712 vom 2026-05-21",
        "url": "https://access.redhat.com/errata/RHSA-2026:19712"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:20042 vom 2026-05-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:20042"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:21658 vom 2026-06-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:21658"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat Developer Hub: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-04T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-05T08:33:21.839+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-0105",
      "initial_release_date": "2026-01-13T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-13T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-01-18T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "3",
          "summary": "Korrektur Plattformauswahl"
        },
        {
          "date": "2026-02-02T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-04T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat und Fedora aufgenommen"
        },
        {
          "date": "2026-02-05T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-10T23:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-11T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-16T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-18T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-03-03T23:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-03-04T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-03-24T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-05-10T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von HCL aufgenommen"
        },
        {
          "date": "2026-05-18T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-05-19T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-20T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-05-26T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-04T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "19"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "WebUI",
                "product": {
                  "name": "HCL BigFix WebUI",
                  "product_id": "T036098",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hcltech:bigfix:webui"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "BigFix"
          }
        ],
        "category": "vendor",
        "name": "HCL"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM DB2",
            "product": {
              "name": "IBM DB2",
              "product_id": "T048379",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:db2:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "IBM InfoSphere Information Server",
            "product": {
              "name": "IBM InfoSphere Information Server",
              "product_id": "T019995",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:infosphere_information_server:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Developer Hub \u003c1.8.2",
                "product": {
                  "name": "Red Hat Enterprise Linux Developer Hub \u003c1.8.2",
                  "product_id": "T049943"
                }
              },
              {
                "category": "product_version",
                "name": "Developer Hub 1.8.2",
                "product": {
                  "name": "Red Hat Enterprise Linux Developer Hub 1.8.2",
                  "product_id": "T049943-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:developer_hub__1.8.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.19.32",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.19.32",
                  "product_id": "T054748"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.19.32",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.19.32",
                  "product_id": "T054748-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.19.32"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.18.43",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.18.43",
                  "product_id": "T054988"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.18.43",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.18.43",
                  "product_id": "T054988-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.18.43"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "T019995",
          "67646",
          "T054748",
          "T054988",
          "T036098",
          "T049943",
          "74185",
          "T048379"
        ]
      },
      "release_date": "2026-01-13T23:00:00.000+00:00",
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-64756",
      "product_status": {
        "known_affected": [
          "T019995",
          "67646",
          "T054748",
          "T054988",
          "T036098",
          "T049943",
          "74185",
          "T048379"
        ]
      },
      "release_date": "2026-01-13T23:00:00.000+00:00",
      "title": "CVE-2025-64756"
    },
    {
      "cve": "CVE-2025-65945",
      "product_status": {
        "known_affected": [
          "T019995",
          "67646",
          "T054748",
          "T054988",
          "T036098",
          "T049943",
          "74185",
          "T048379"
        ]
      },
      "release_date": "2026-01-13T23:00:00.000+00:00",
      "title": "CVE-2025-65945"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Bamboo ist ein Werkzeug zur kontinuierlichen Integration und Bereitstellung, das automatisierte Builds, Tests und Freigaben in einem einzigen Arbeitsablauf verbindet.\r\nBitbucket ist ein Git-Server zur Sourcecode-Versionskontrolle.\r\nConfluence ist eine kommerzielle Wiki-Software.\r\nJira ist eine Webanwendung zur Softwareentwicklung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuf\u00fchren, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuf\u00fchren, und um einen Cross-Site Scripting Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0177 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0177.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0177 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0177"
      },
      {
        "category": "external",
        "summary": "Atlassian Support Security Bulletin vom 2026-01-20",
        "url": "https://confluence.atlassian.com/security/security-bulletin-january-20-2026-1712324819.html"
      },
      {
        "category": "external",
        "summary": "Deell Security Update",
        "url": "https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Bulletin - March 17 2026",
        "url": "https://confluence.atlassian.com/security/security-bulletin-march-17-2026-1721271371.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Atlassian Bamboo, Bitbucket, Confluence und Jira: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-18T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-19T09:58:07.378+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0177",
      "initial_release_date": "2026-01-20T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-01-25T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2026-01-28T23:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-4913"
        },
        {
          "date": "2026-03-17T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2026-03-18T23:00:00.000+00:00",
          "number": "5",
          "summary": "doppelte Eintragung bereinigt"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c12.0.2",
                "product": {
                  "name": "Atlassian Bamboo Data Center \u003c12.0.2",
                  "product_id": "T050227"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 12.0.2",
                "product": {
                  "name": "Atlassian Bamboo Data Center 12.0.2",
                  "product_id": "T050227-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center__12.0.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.2.13",
                "product": {
                  "name": "Atlassian Bamboo Data Center \u003c10.2.13",
                  "product_id": "T050228"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.2.13",
                "product": {
                  "name": "Atlassian Bamboo Data Center 10.2.13",
                  "product_id": "T050228-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center__10.2.13"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c9.6.21",
                "product": {
                  "name": "Atlassian Bamboo Data Center \u003c9.6.21",
                  "product_id": "T050229"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 9.6.21",
                "product": {
                  "name": "Atlassian Bamboo Data Center 9.6.21",
                  "product_id": "T050229-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:data_center__9.6.21"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.1.3 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo \u003c12.1.3 (LTS)",
                  "product_id": "T051830"
                }
              },
              {
                "category": "product_version",
                "name": "12.1.3 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo 12.1.3 (LTS)",
                  "product_id": "T051830-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:12.1.3_%28lts%29"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.2.16 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo \u003c10.2.16 (LTS)",
                  "product_id": "T051831"
                }
              },
              {
                "category": "product_version",
                "name": "10.2.16 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo 10.2.16 (LTS)",
                  "product_id": "T051831-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:10.2.16_%28lts%29"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.6.24 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo \u003c9.6.24 (LTS)",
                  "product_id": "T051832"
                }
              },
              {
                "category": "product_version",
                "name": "9.6.24 (LTS)",
                "product": {
                  "name": "Atlassian Bamboo 9.6.24 (LTS)",
                  "product_id": "T051832-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bamboo:9.6.24_%28lts%29"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bamboo"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.1.1",
                "product": {
                  "name": "Atlassian Bitbucket Data Center \u003c10.1.1",
                  "product_id": "T050230"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.1.1",
                "product": {
                  "name": "Atlassian Bitbucket Data Center 10.1.1",
                  "product_id": "T050230-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center__10.1.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c9.4.15",
                "product": {
                  "name": "Atlassian Bitbucket Data Center \u003c9.4.15",
                  "product_id": "T050231"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 9.4.15",
                "product": {
                  "name": "Atlassian Bitbucket Data Center 9.4.15",
                  "product_id": "T050231-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center__9.4.15"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c8.19.26",
                "product": {
                  "name": "Atlassian Bitbucket Data Center \u003c8.19.26",
                  "product_id": "T050232"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 8.19.26",
                "product": {
                  "name": "Atlassian Bitbucket Data Center 8.19.26",
                  "product_id": "T050232-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:data_center__8.19.26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.1.5",
                "product": {
                  "name": "Atlassian Bitbucket \u003c10.1.5",
                  "product_id": "T051833"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.5",
                "product": {
                  "name": "Atlassian Bitbucket 10.1.5",
                  "product_id": "T051833-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:10.1.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.2.0 to 10.2.1",
                "product": {
                  "name": "Atlassian Bitbucket \u003c10.2.0 to 10.2.1",
                  "product_id": "T051834"
                }
              },
              {
                "category": "product_version",
                "name": "10.2.0 to 10.2.1",
                "product": {
                  "name": "Atlassian Bitbucket 10.2.0 to 10.2.1",
                  "product_id": "T051834-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:10.2.0_to_10.2.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.4.17 to 9.4.18",
                "product": {
                  "name": "Atlassian Bitbucket \u003c9.4.17 to 9.4.18",
                  "product_id": "T051835"
                }
              },
              {
                "category": "product_version",
                "name": "9.4.17 to 9.4.18",
                "product": {
                  "name": "Atlassian Bitbucket 9.4.17 to 9.4.18",
                  "product_id": "T051835-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:bitbucket:9.4.17_to_9.4.18"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Bitbucket"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.2.2",
                "product": {
                  "name": "Atlassian Confluence Data Center \u003c10.2.2",
                  "product_id": "T050233"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.2.2",
                "product": {
                  "name": "Atlassian Confluence Data Center 10.2.2",
                  "product_id": "T050233-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center__10.2.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c9.2.13",
                "product": {
                  "name": "Atlassian Confluence Data Center \u003c9.2.13",
                  "product_id": "T050234"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 9.2.13",
                "product": {
                  "name": "Atlassian Confluence Data Center 9.2.13",
                  "product_id": "T050234-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:confluence:data_center__9.2.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Confluence"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Data Center \u003c11.3.0",
                "product": {
                  "name": "Atlassian Jira Data Center \u003c11.3.0",
                  "product_id": "T050235"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 11.3.0",
                "product": {
                  "name": "Atlassian Jira Data Center 11.3.0",
                  "product_id": "T050235-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:data_center__11.3.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c11.2.1",
                "product": {
                  "name": "Atlassian Jira Data Center \u003c11.2.1",
                  "product_id": "T050236"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 11.2.1",
                "product": {
                  "name": "Atlassian Jira Data Center 11.2.1",
                  "product_id": "T050236-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:data_center__11.2.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Data Center \u003c10.3.16",
                "product": {
                  "name": "Atlassian Jira Data Center \u003c10.3.16",
                  "product_id": "T050237"
                }
              },
              {
                "category": "product_version",
                "name": "Data Center 10.3.16",
                "product": {
                  "name": "Atlassian Jira Data Center 10.3.16",
                  "product_id": "T050237-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:data_center__10.3.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.12.26",
                "product": {
                  "name": "Atlassian Jira \u003c9.12.26",
                  "product_id": "T050238"
                }
              },
              {
                "category": "product_version",
                "name": "9.12.26",
                "product": {
                  "name": "Atlassian Jira 9.12.26",
                  "product_id": "T050238-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:atlassian:jira:9.12.26"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Jira"
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c19.12",
                "product": {
                  "name": "Dell Data Protection Advisor \u003c19.12",
                  "product_id": "T050283"
                }
              },
              {
                "category": "product_version",
                "name": "19.12",
                "product": {
                  "name": "Dell Data Protection Advisor 19.12",
                  "product_id": "T050283-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:dell:data_protection_advisor:19.12"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Data Protection Advisor"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3807",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2021-3807"
    },
    {
      "cve": "CVE-2022-25883",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2022-25883"
    },
    {
      "cve": "CVE-2022-45693",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2022-45693"
    },
    {
      "cve": "CVE-2024-21538",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2024-21538"
    },
    {
      "cve": "CVE-2024-38286",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2024-38286"
    },
    {
      "cve": "CVE-2024-45296",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2024-45296"
    },
    {
      "cve": "CVE-2024-45801",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2024-45801"
    },
    {
      "cve": "CVE-2025-12383",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-12383"
    },
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-27152",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-27152"
    },
    {
      "cve": "CVE-2025-41249",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-41249"
    },
    {
      "cve": "CVE-2025-48976",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-48976"
    },
    {
      "cve": "CVE-2025-48989",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-48989"
    },
    {
      "cve": "CVE-2025-49146",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-49146"
    },
    {
      "cve": "CVE-2025-52434",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-52434"
    },
    {
      "cve": "CVE-2025-52999",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-52999"
    },
    {
      "cve": "CVE-2025-53689",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-53689"
    },
    {
      "cve": "CVE-2025-54988",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-54988"
    },
    {
      "cve": "CVE-2025-55163",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-55163"
    },
    {
      "cve": "CVE-2025-55752",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-55752"
    },
    {
      "cve": "CVE-2025-64775",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-64775"
    },
    {
      "cve": "CVE-2025-66516",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-66516"
    },
    {
      "cve": "CVE-2025-9287",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-9287"
    },
    {
      "cve": "CVE-2025-9288",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-9288"
    },
    {
      "cve": "CVE-2026-21569",
      "product_status": {
        "known_affected": [
          "T050283",
          "T050235",
          "T051831",
          "T050234",
          "T051832",
          "T050237",
          "T050236",
          "T051830",
          "T050231",
          "T050230",
          "T050233",
          "T050232",
          "T050228",
          "T051835",
          "T050227",
          "T050238",
          "T051833",
          "T050229",
          "T051834"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2026-21569"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "ILIAS ist eine Open Source e-Learning L\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in ILIAS ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, und um einen Cross-Site Scripting Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0181 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0181.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0181 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0181"
      },
      {
        "category": "external",
        "summary": "Ilias Security-Blog 10.5 vom 2026-01-20",
        "url": "https://docu.ilias.de/go/blog/15821/899"
      },
      {
        "category": "external",
        "summary": "Ilias Security-Blog 9.17 vom 2026-01-20",
        "url": "https://docu.ilias.de/go/blog/15821/898"
      },
      {
        "category": "external",
        "summary": "Ilias Release Notes 10.5 vom 2026-01-20",
        "url": "https://docu.ilias.de/go/pg/220557_35"
      },
      {
        "category": "external",
        "summary": "Ilias Release Notes 9.17 vom 2026-01-20",
        "url": "https://docu.ilias.de/go/pg/220555_35"
      },
      {
        "category": "external",
        "summary": "NIST CVE-2025-55166",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55166"
      },
      {
        "category": "external",
        "summary": "NIST CVE-2025-15284",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284"
      }
    ],
    "source_lang": "en-US",
    "title": "ILIAS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-01-20T23:00:00.000+00:00",
      "generator": {
        "date": "2026-01-21T11:39:09.007+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0181",
      "initial_release_date": "2026-01-20T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-20T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.5",
                "product": {
                  "name": "Open Source ILIAS \u003c10.5",
                  "product_id": "T050243"
                }
              },
              {
                "category": "product_version",
                "name": "10.5",
                "product": {
                  "name": "Open Source ILIAS 10.5",
                  "product_id": "T050243-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ilias:ilias:10.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.17",
                "product": {
                  "name": "Open Source ILIAS \u003c9.17",
                  "product_id": "T050244"
                }
              },
              {
                "category": "product_version",
                "name": "9.17",
                "product": {
                  "name": "Open Source ILIAS 9.17",
                  "product_id": "T050244-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ilias:ilias:9.17"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ILIAS"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "T050244",
          "T050243"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-55166",
      "product_status": {
        "known_affected": [
          "T050244"
        ]
      },
      "release_date": "2026-01-20T23:00:00.000+00:00",
      "title": "CVE-2025-55166"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift Container Platform ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0243 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0243.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0243 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0243"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory vom 2026-01-27",
        "url": "https://access.redhat.com/errata/RHSA-2026:1000"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1517 vom 2026-01-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:1517"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:1552 vom 2026-02-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:1552"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2149 vom 2026-02-05",
        "url": "https://access.redhat.com/errata/RHSA-2026:2149"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2148 vom 2026-02-05",
        "url": "https://access.redhat.com/errata/RHSA-2026:2148"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2762 vom 2026-02-16",
        "url": "https://access.redhat.com/errata/RHSA-2026:2762"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:2681 vom 2026-02-16",
        "url": "https://access.redhat.com/errata/RHSA-2026:2681"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:3712 vom 2026-03-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:3712"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat OpenShift Container Platform: Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2026-03-03T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-04T11:19:00.203+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0243",
      "initial_release_date": "2026-01-27T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-01-27T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-01-28T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-03T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-05T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-02-16T23:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-03-03T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "6"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.20.12",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.20.12",
                  "product_id": "T050367"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.20.12",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.20.12",
                  "product_id": "T050367-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.20.12"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "67646",
          "T050367"
        ]
      },
      "release_date": "2026-01-27T23:00:00.000+00:00",
      "title": "CVE-2025-15284"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM App Connect Enterprise kombiniert die branchenbew\u00e4hrten Technologien des IBM Integration Bus mit Cloud-nativen Technologien.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0301 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0301.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0301 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0301"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-02-03",
        "url": "https://www.ibm.com/support/pages/node/7259600"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7266733 vom 2026-03-24",
        "url": "https://www.ibm.com/support/pages/node/7266733"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7268736 vom 2026-04-07",
        "url": "https://www.ibm.com/support/pages/node/7268736"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM App Connect Enterprise: Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2026-04-07T22:00:00.000+00:00",
      "generator": {
        "date": "2026-04-08T09:54:48.982+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0301",
      "initial_release_date": "2026-02-03T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-02-03T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-03-24T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-04-07T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c12.0.12.22",
                "product": {
                  "name": "IBM App Connect Enterprise \u003c12.0.12.22",
                  "product_id": "T050515"
                }
              },
              {
                "category": "product_version",
                "name": "12.0.12.22",
                "product": {
                  "name": "IBM App Connect Enterprise 12.0.12.22",
                  "product_id": "T050515-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:12.0.12.22"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c13.0.6.1",
                "product": {
                  "name": "IBM App Connect Enterprise \u003c13.0.6.1",
                  "product_id": "T050516"
                }
              },
              {
                "category": "product_version",
                "name": "13.0.6.1",
                "product": {
                  "name": "IBM App Connect Enterprise 13.0.6.1",
                  "product_id": "T050516-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:13.0.6.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Operator \u003c12.0.22",
                "product": {
                  "name": "IBM App Connect Enterprise Container Operator \u003c12.0.22",
                  "product_id": "T052447"
                }
              },
              {
                "category": "product_version",
                "name": "Container Operator 12.0.22",
                "product": {
                  "name": "IBM App Connect Enterprise Container Operator 12.0.22",
                  "product_id": "T052447-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:certified_container_operator__12.0.22"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Certified Container Operator \u003c13.0.0",
                "product": {
                  "name": "IBM App Connect Enterprise Certified Container Operator \u003c13.0.0",
                  "product_id": "T052448"
                }
              },
              {
                "category": "product_version",
                "name": "Certified Container Operator 13.0.0",
                "product": {
                  "name": "IBM App Connect Enterprise Certified Container Operator 13.0.0",
                  "product_id": "T052448-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:app_connect_enterprise:certified_container_operator__13.0.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "App Connect Enterprise"
          },
          {
            "category": "product_name",
            "name": "IBM InfoSphere Information Server",
            "product": {
              "name": "IBM InfoSphere Information Server",
              "product_id": "T019995",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:infosphere_information_server:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "T019995",
          "T050516",
          "T050515",
          "T052447",
          "T052448"
        ]
      },
      "release_date": "2026-02-03T23:00:00.000+00:00",
      "title": "CVE-2025-15284"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM Planning Analytics ist eine Softwarel\u00f6sung f\u00fcr Unternehmensplanung und -analyse, die Budgetierung, Forecasting und Reporting unterst\u00fctzt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM Planning Analytics ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0759 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0759.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0759 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0759"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-17",
        "url": "https://www.ibm.com/support/pages/node/7263581"
      },
      {
        "category": "external",
        "summary": "Github Advisory vom 2025-11-27 mit PoC",
        "url": "https://github.com/advisories/GHSA-rcmh-qjqh-p98v"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM Planning Analytics: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-17T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-18T10:53:05.398+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0759",
      "initial_release_date": "2026-03-17T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-17T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.1.18",
                "product": {
                  "name": "IBM Planning Analytics \u003c2.1.18",
                  "product_id": "T051806"
                }
              },
              {
                "category": "product_version",
                "name": "2.1.18",
                "product": {
                  "name": "IBM Planning Analytics 2.1.18",
                  "product_id": "T051806-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:planning_analytics:2.1.18"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Planning Analytics"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14874",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-14874"
    },
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-61729",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-61729"
    },
    {
      "cve": "CVE-2025-14806",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-14806"
    },
    {
      "cve": "CVE-2026-1267",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2026-1267"
    },
    {
      "cve": "CVE-2025-61727",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-61727"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "niedrig"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Das DataPower Gateway ist eine Software zur Unterst\u00fctzung von Unternehmen bei der Erf\u00fcllung der Sicherheits- und Integrationsanforderungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM DataPower Gateway ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0943 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0943.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0943 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0943"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7268152 vom 2026-03-31",
        "url": "https://www.ibm.com/support/pages/node/7268152"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM DataPower Gateway: Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2026-03-31T22:00:00.000+00:00",
      "generator": {
        "date": "2026-04-01T10:39:12.500+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0943",
      "initial_release_date": "2026-03-31T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-31T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c11.0.0.0",
                "product": {
                  "name": "IBM DataPower Gateway \u003c11.0.0.0",
                  "product_id": "T052336"
                }
              },
              {
                "category": "product_version",
                "name": "11.0.0.0",
                "product": {
                  "name": "IBM DataPower Gateway 11.0.0.0",
                  "product_id": "T052336-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:11.0.0.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.6.0.9",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.6.0.9",
                  "product_id": "T052337"
                }
              },
              {
                "category": "product_version",
                "name": "10.6.0.9",
                "product": {
                  "name": "IBM DataPower Gateway 10.6.0.9",
                  "product_id": "T052337-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.6.0.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.5.0.21",
                "product": {
                  "name": "IBM DataPower Gateway \u003c10.5.0.21",
                  "product_id": "T052338"
                }
              },
              {
                "category": "product_version",
                "name": "10.5.0.21",
                "product": {
                  "name": "IBM DataPower Gateway 10.5.0.21",
                  "product_id": "T052338-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.5.0.21"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DataPower Gateway"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "T052337",
          "T052338",
          "T052336"
        ]
      },
      "release_date": "2026-03-31T22:00:00.000+00:00",
      "title": "CVE-2025-15284"
    }
  ]
}