Threats affecting pkg:generic/zxc

A vulnerability in abrt-server allows a local attacker to read environment variables and related metadata of other users' or root processes. This occurs because abrt-server, running as root, trusts a client-supplied process ID (PID) when creating problem dumps over abrt.socket and copies the /proc data of that process into a dump directory owned by the unprivileged user. This flaw enables unauthorized local information disclosure.

Control Web Panel (CWP) versions prior to 1.30.6 have a host header injection vulnerability in the password recovery process. This flaw allows unauthenticated attackers to manipulate the HTTP Host header in the /v1/lostpass/ route, poisoning the reset URL. By tricking an automated mail-security scanner into visiting this malicious link, attackers can exfiltrate the live recovery token, use it to reset the password, and then abuse File Manager and Crontab modules to execute commands under the targeted hosting account.

IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands have a vulnerability related to log forging when processing requests to create resources. This vulnerability can allow an attacker with low privileges to manipulate log entries, potentially impacting confidentiality and integrity of logged data. The vulnerability does not affect availability. It has a high severity score of 8.1 according to CVSS 3.1.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.11 contain a vulnerability that allows an authenticated user with tool-registration privileges to cause a denial of service. This occurs due to uncontrolled regular expression complexity (ReDoS) in the JSON Schema pattern field, which can lead to excessive CPU consumption during argument validation, potentially degrading gateway availability.

Poste Italiane Postecert FIRMAOK! version 1.6.29 on Windows has a local privilege escalation vulnerability due to an uncontrolled OpenSSL search path. The application loads OpenSSL configuration and library files from a hardcoded directory that is user-writable and missing by default. A local attacker with low privileges can create this directory and place malicious files to execute code with the privileges of the user running the application, potentially escalating privileges to full system compromise.

The HashiCorp cap JWT validation library versions before 0.14.0 contain a vulnerability that allows bypassing claims validation. This flaw may cause downstream applications to make authorization decisions based on unvalidated claim values. The vulnerability requires attacker-controlled claims in a JWT signed by a trusted key. It is fixed in version 0.14.0.

IBM Security QRadar EDR versions 3.12 through 3.12.26 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions due to improper rate limiting on TOTP verification. This flaw could enable attackers with valid credentials to circumvent multi-factor authentication protections.

IBM Bob version 2.0.3 contains a vulnerability where unauthorized browser extensions can retrieve session tokens through the authentication provider API. The session token is exposed in the account identifier field during account enumeration without requiring explicit user consent. This exposure could allow malicious extensions to access sensitive session information. The vulnerability has a low CVSS score of 3.3, indicating limited impact. No patch or remediation information is currently available.

IBM Security QRadar EDR versions 3.12 through 3.12.26 contain an improper access control vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality.

Control Web Panel (CWP) versions before 1.30.6 have an authorization bypass vulnerability in the validate() function of api/v1/index.php. This flaw allows attackers possessing a password-recovery token and a predictable legacy signature to gain remote API authorization without a valid API key. Exploitation via the POST /cronjobsusers/ endpoint enables attackers to add arbitrary cron commands, resulting in command execution under the affected hosting account. Additionally, attackers can access global account lists and details, exposing sensitive user information including usernames, contact emails, and password hashes.

A vulnerability exists in dbus when configured with the nonce-tcp transport, allowing an unauthenticated attacker to cause a denial of service (DoS) by opening a connection and withholding the expected authentication token. This stalls the server's accept process, blocking legitimate clients from connecting. The issue arises because the server does not enforce a timeout during authentication verification. Default installations are not affected as they use local UNIX domain sockets. Exploitation requires explicit configuration of the nonce-tcp transport and network exposure.

IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a vulnerability that could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context. The vulnerability has a low severity score and does not impact confidentiality or availability but may cause limited integrity issues.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a stack buffer overflow vulnerability in the QFileSvr.400 file system due to improper bounds checking. A local authenticated attacker could exploit this by sending a crafted command to cause undefined behavior.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability requires authentication and does not involve user interaction. It has a medium severity rating with a CVSS score of 6.4.

IBM ContextForge MCP Gateway versions 1.0.0 through 1.1.0 contain a vulnerability that allows attackers to replay identity propagation claim signatures or expose sensitive user identity information to third-party MCP servers. This occurs due to the use of static signature payloads and the absence of per-gateway configuration checks during tool invocation. The vulnerability has a high severity rating with a CVSS score of 7.4.

Devolutions PowerShell Universal versions 2026.3.4 and earlier have incorrect default permissions on the agent configuration folder. This vulnerability allows a local unprivileged user to execute arbitrary code with SYSTEM privileges by crafting a malicious agent configuration file that directs the agent to an attacker-controlled server.

IBM webMethods Integration Server versions 10.15 and 11.1 have a vulnerability that could allow a remote attacker to obtain sensitive information. This exposure involves server-side environment variables and Java runtime details, which could aid an attacker in further attacks or reconnaissance.

A flaw in abrt's mitigation for CVE-2026-54228 and CVE-2026-54229 allows local attackers to bypass the completeness check by creating a 'count' element in dump directories. This enables poisoning or ownership seizure of dump directories during privileged ABRT handler processing. The issue stems from an incomplete fix that leaves certain mutating methods ungated, allowing unauthorized modification and access. Mitigation involves disabling or removing ABRT if not required and restricting local user access.

A CWE-922 Insecure Storage of Sensitive Information vulnerability affects multiple Johnson Controls iSTAR Ultra product lines prior to version 6.9.2.CU02. This vulnerability allows file manipulation as described by CAPEC-15. The issue has a medium severity with a CVSS score of 6.3. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

IBM Cyber Fraud versions 1.0.0 through 1.1.0 contain a vulnerability that could allow an attacker with local access to a container to extract sensitive information. This issue arises from unrestrictive network policies within the affected versions. The vulnerability has a medium severity rating with a CVSS score of 4. No known exploits are reported in the wild, and no patches or fixes have been explicitly stated.