Most recent entries from all

EUVD-2026-228183

fkie_cve-2025-32379

Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

GHSA-x2rg-q646-7m2v — Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

Affected: npm: koa

### Summary In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.

### Patches This issue is patched in 2.16.1 and 3.0.0-alpha.5.

### PoC Coming soon...

### Impact 1. Redirect user to another phishing site 2. Make request to another endpoint of the application based on user's cookie 3. Steal user's cookie

WID-SEC-W-2025-2424 — IBM Rational Team Concert: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM Rational Team Concert ausnutzen, um einen Denial-of-Service-Angriff durchzuführen, Eingaben oder Protokolle zu manipulieren, die Authentifizierung zu umgehen, beliebigen Code auszuführen, Cross-Site-Scripting durchzuführen, sensible Informationen offenzulegen oder offene Weiterleitungen auszulösen.