CVE-2025-15449

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be...

CVE-2025-15448

A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/com/macro/mall/controller/MinioController.java. The manipulation results in unrestricted upload. It is possible to launch the attack...

CVE-2025-15449

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be...

CVE-2025-15449

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be...

EUVD-2026-0921

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be...

CVE-2025-15449 cld378632668 JavaMall MinioController.java delete path traversal

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be...

mall 代码问题漏洞

mall is a macro individual developer of a set of e-commerce system, including the front mall system and backend management system. A code issue vulnerability exists in mall 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 and prior versions, which stems from an incorrect operation of the function in the...

mall 路径遍历漏洞

mall is a macro individual developer of a set of e-commerce system, including the front mall system and backend management system. mall 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 and previous versions of the path traversal vulnerability exists, the vulnerability stems from the file...

PT-2026-1200

Name of the Vulnerable Software and Affected Versions JavaMall versions prior to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0 Description A flaw exists in JavaMall that allows for unrestricted file uploads. This issue impacts the Upload function within the file...

PT-2026-03: Access Control Violation Vulnerability in PT NGFW

The vulnerability was identified in PT NGFW, version1.8.1 certified. The discovered vulnerability can be exploited by an attacker to gain access to MinIO backups. The exfiltrated data can be used for reconnaissance of the organization's infrastructure to conduct subsequent attacks on the system...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in MinIO [CVE-2025-59952]

Summary IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in MinIO, due to an unintended behavior with XML tag values CVE-2025-59952. MinIO is used in our java microservices. This vulnerabilitiy has been addressed. Please read the details for remediation below...

Privilege Escalation

github.com/minio/minio is vulnerable to privilege escalation. The vulnerability is due to improper IAM session-policy validation, where restricted service or STS accounts can bypass inline policy checks when creating new service accounts, which allows an attacker to escalate privileges and gain...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: gotestsum, neuvector-sigstore-interface, syft, consul, regclient-fips, temporal-fips, k8s-agents-operator-fips, logstash-exporter-fips, rabbitmq-default-user-credential-updater, aws-signer-notation-plugin-fips, k8ssandra-client-fips, kubeflow-fips, rke2-cloud-provide...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: gotestsum, neuvector-sigstore-interface, syft, consul, regclient-fips, temporal-fips, k8s-agents-operator-fips, logstash-exporter-fips, rabbitmq-default-user-credential-updater, aws-signer-notation-plugin-fips, k8ssandra-client-fips, kubeflow-fips, rke2-cloud-provide...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: spire-server, nfs-subdir-external-provisioner, rancher-telemetry, mongodb-kubernetes-operator, kubernetes-csi-livenessprobe, sftpgo-plugin-eventsearch, falco-no-driver, aws-load-balancer-controller, nri-mysql, terraform-provider-tls,...

GHSA-32FW-GQ77-F2F2 vulnerabilities

Vulnerabilities for packages: minio, falcosidekick, bento...

CVE-2025-10543 vulnerabilities

Vulnerabilities for packages: minio, falcosidekick, bento...

GHSA-32FW-GQ77-F2F2 vulnerabilities

Vulnerabilities for packages: dapr-fips, falcosidekick-fips, zabbix-agent2-fips, minio, agentbeat, agentbeat-fips, elastic-agent-fips, bento, telegraf, elastic-agent, beats-fips, beats, minio-fips, falcosidekick, dapr, influxd, zabbix-agent2...

CVE-2025-10543 vulnerabilities

Vulnerabilities for packages: dapr-fips, falcosidekick-fips, zabbix-agent2-fips, minio, agentbeat, agentbeat-fips, elastic-agent-fips, bento, telegraf, elastic-agent, beats-fips, beats, minio-fips, falcosidekick, dapr, influxd, zabbix-agent2...

ROS-20251113-04

The MinIO object storage server vulnerability is related to flaws in the authorization mechanism. Exploitation exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...