CVE-2025-53698 is a vulnerability in Johnson Controls iSTAR Ultra and iSTAR Ultra SE devices prior to version 6.9.2.CU02. It involves a missing protection mechanism for an alternate hardware interface, which can lead to functionality bypass as described by CAPEC-554. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.0. A fix is available in version 6.9.2.CU02.
IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a stack-based buffer overflow vulnerability in the QFileSvr.400 file system due to improper bounds checking. A local authenticated attacker could trigger undefined behavior by sending a crafted command. The vulnerability has a CVSS score of 5.3, indicating medium severity.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system. This may enable network enumeration or assist in launching further attacks. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation information is provided in the available data.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain an improper access control vulnerability in the bulk import functionality. A remote authenticated attacker with team-scoped admin.import permission can manipulate the endpoint URL, request headers, and authentication credentials of public tools, resources, and prompts owned by other tenants. This is achieved by sending a crafted POST request to the /v1/import endpoint with conflict_strategy=update, causing subsequent AI gateway calls to be redirected to an attacker-controlled host.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a cross-site scripting (XSS) vulnerability. This flaw allows a privileged user to inject arbitrary JavaScript code into the web interface, potentially altering its intended functionality and leading to the disclosure of credentials within a trusted session.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 contain an improper authentication vulnerability. The X-Upstream-Authorization HTTP header can override the gateway-managed upstream credentials for OAuth, bearer, and basic authentication methods. This flaw allows an authenticated user to make upstream requests using different credentials, potentially bypassing per-user permissions and audit attribution controls.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a vulnerability where an authenticated user with tool-registration privileges can embed complex regular expressions in a tool's JSON Schema pattern field. This can cause excessive CPU consumption during argument validation, leading to denial of service and degraded gateway availability.
IBM ContextForge MCP Gateway versions 1.0.8 through 1.0.11 and 1.1.0 have a vulnerability in the jq filter guard module due to an incomplete denylist of disallowed inputs. An authenticated remote attacker can exploit this by supplying crafted jsonpath_filter values containing certain built-ins like halt, halt_error, or unbounded loops, leading to denial of service through worker process termination or resource exhaustion.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain an improper authentication vulnerability. This flaw allows an authenticated user to bypass upstream credential-level authorization policies by exploiting an insufficiently specific cache key in the RFC 8693 token exchange cache. As a result, cached upstream bearer tokens can be reused across different credentials belonging to the same user, potentially leading to unauthorized access.
Control Web Panel versions prior to 1.30.6 contain an authorization bypass vulnerability in the validate() function of api/v1/index.php. Attackers possessing a password-recovery token and a predictable legacy signature can bypass proper API key authorization. Exploitation via the POST /cronjobsusers/ endpoint allows adding arbitrary cron commands, leading to command execution under the hosting account. Additionally, the vulnerability permits unauthorized access to global account lists and details, exposing usernames, contact emails, and password hashes. This vulnerability is rated critical with a CVSS 4.0 score of 9.2 and was fixed in version 1.30.6.
IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 contain an authentication bypass vulnerability due to replay of identity propagation claims signatures. This occurs because of static signature payloads and missing per-gateway configuration checks during tool invocation, potentially exposing sensitive user identity information to third-party MCP servers.
Control Web Panel versions before 1.30.6 have a host header injection vulnerability in the password recovery mechanism. This flaw allows unauthenticated attackers to manipulate the reset URL by injecting a malicious HTTP Host header. Exploitation can lead to exfiltration of live recovery tokens, unauthorized password resets, and command execution via File Manager and Crontab modules on the targeted hosting account.
A vulnerability in dbus configured with the nonce-tcp transport in Red Hat Enterprise Linux 10 allows an unauthenticated attacker to cause a Denial of Service (DoS). By opening a connection and withholding the expected authentication token, the attacker stalls the server's accept process due to lack of a timeout, blocking legitimate clients from connecting. Default installations are not affected as they use local UNIX domain sockets. Exploitation requires explicit configuration of the nonce-tcp transport and network exposure.
Poste Italiane Postecert FIRMAOK! version 1.6.29 on Windows has a local privilege escalation vulnerability due to an uncontrolled OpenSSL search path. The application loads OpenSSL configuration and library files from a hardcoded directory that is user-writable and missing by default. A low-privileged attacker can create this directory and place malicious files to execute code with the privileges of the user running the application, potentially escalating privileges to full system compromise.
CVE-2025-53697 is a high-severity vulnerability in Johnson Controls iSTAR Ultra and related products caused by the use of default credentials. This affects multiple product variants including iSTAR Ultra, iSTAR Ultra SE, iSTAR Ultra G2, iSTAR Ultra G2 SE, and iSTAR Edge G2 before specific fixed versions. The vulnerability allows unauthorized access due to default credential usage, categorized under CWE-1392. Fixed versions are available.
The npm package 'dowload_ebok_to_kill_and_kill_again_by_john_coston_id159' is identified as malicious software. Any system with this package installed or running is considered fully compromised. It is recommended to immediately rotate all secrets and keys from a different, uncompromised computer. Removing the package alone may not eliminate all malicious components due to potential full control by an external attacker.
The npm package 'dowload_ebok_aws_lambda_in_action_by_danilo_poccia_o3xgh' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is strongly advised.
The npm package 'dowload_ebok_honey_so_sweet_vol_5_by_amu_meguro_6vbdo' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eliminate the malicious software or restore system integrity.
The npm package 'dowload_ebok_ecchi_gallery_by_takumi_kobayashi_c8fuf' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone does not guarantee full remediation due to potential persistence of malicious software.
The npm package 'dowload_ebok_puppy_love_by_rachel_renee_russell_7ae7c' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.