Security Bulletin: Apache Commons FileUpload used by IBM InfoSphere Identity Insight has a potential vulnerability (CVE-2025-48976))

Summary Apache Commons FileUpload used by IBM InforSphere Identity Insight provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A specially crafted request that used a large number of parts with large headers could trigger excessive memory usage...

Malware in seller-assistant-commons-fe

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Apache Commons Lang DoS Vulnerability (Jul 2025)

The Apache Commons Lang library is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...

com.adobe.granite:com.adobe.granite.testing.external-systems (0.0.3), com.adobe.granite:com.adobe.granite.testing.granite-it-framework (1.0.36) +30 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (2.22.0)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-spi-commons and may be impacted: - com.adobe.granite:com.adobe.granite.testing.external-systems 0.0.3 -...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4, <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=4.0.0, <=4.2.4) +50 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.20.0, <=2.20.16)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.20.0, =2.5.4, =4.0.0, =4.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.6, =1.4.20, =1.3, =1.3, =1.11.0, =1.11.0, =1.11.0, =2.24.0 and more Source cves: CVE-2025-53689 Source advisory: OSV:GH...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory:...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to the use of an unsecured document to load privileges. An attacker can execute arbitrary code or cause a denial of service by submitting specially crafted XML data. Details XXE Injection is a type ...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4, <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=4.0.0, <=4.2.4) +50 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.20.0, <=2.20.16)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.20.0, =2.5.4, =4.0.0, =4.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.6, =1.4.20, =1.3, =1.3, =1.11.0, =1.11.0, =1.11.0, =2.24.0 and more Source cves: CVE-2025-53689 Source advisory: GHSA-4...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: OSV:GHSA-44C3-38H8-9FH9...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: GHSA-44C3-38H8-9FH9...

DEBIAN-CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

UBUNTU-CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

org.apache.jackrabbit:jackrabbit-core (>=2.23.0-beta, <=2.23.1-beta), org.apache.jackrabbit:jackrabbit-jca (>=2.23.0-beta, <=2.23.1-beta) +8 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.23.0-beta, <=2.23.1-beta)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.0-beta, =2.23.1-beta Source cves: CVE-2025-53689 Source advisory: MEND:CVE-2025-53689...

CVE-2025-53689

Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 Java 8, 2.22.1 Java 11 or 2.23.2 Java 11, beta versions, which fix this issue...

com.adobe.granite:com.adobe.granite.testing.external-systems (0.0.3), com.adobe.granite:com.adobe.granite.testing.granite-it-framework (1.0.36) +30 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (2.22.0)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.jackrabbit:jackrabbit-spi-commons and may be impacted: - com.adobe.granite:com.adobe.granite.testing.external-systems 0.0.3 -...

biz.netcentric.cq.tools.accesscontroltool:maximum-environment (>=2.5.4, <=3.6.2), biz.netcentric.cq.tools.accesscontroltool:minimum-environment (>=4.0.0, <=4.2.4) +50 more potentially affected by CVE-2025-53689 via org.apache.jackrabbit:jackrabbit-spi-commons (>=2.20.0, <=2.20.16)

org.apache.jackrabbit:jackrabbit-spi-commons MAVEN version =2.20.0, =2.5.4, =4.0.0, =4.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.6, =1.4.20, =1.3, =1.3, =1.11.0, =1.11.0, =1.11.0, =2.24.0 and more Source cves: CVE-2025-53689 Source advisory: MEND:C...