Arbitrary File Upload

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Arbitrary File Upload due to the TryZipProviderSafe process. An attacker can create files with unauthorized extensions by exploiting...

[SECURITY] [DLA 4116-1] abseil security update

Debian LTS Advisory DLA-4116-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost April 05, 2025 https://wiki.debian.org/LTS Package : abseil Version : 020200923.3-2+deb11u1 CVE ID : CVE-2025-0838 Debian Bug : 1098903 A vulnerability has been found in abseil, a collecti...

SUSE-SU-2025:1143-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2024-45337: golang.org/x/crypto/ssh: Fixed misuse of ServerConfig.PublicKeyCallback leading to authorization bypass bsc1234563. Other fixes: - Updated to version 20250327.01 bsc1239763, bsc1239866 Remove error messages from...

XXE (XML External Entity Injection) org.codehaus.jackson:jackson-mapper-asl Dependency in Confluence Data Center and Server

This High severity XXE XML External Entity Injection org.codehaus.jackson:jackson-mapper-asl Dependency vulnerability was introduced in versions 8.5 of Confluence Data Center and Server. This org.codehaus.jackson:jackson-mapper-asl Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS...

CVE-2025-3199 ageerle ruoyi-ai API Interface SysModelController.java improper authorization

A vulnerability was found in ageerle ruoyi-ai up to 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/controller/system/SysModelController.java of the component API Interface. The manipulati...

CVE-2025-30676

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue...

CVE-2024-53868 Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue...

CVE-2024-53868

Apache Traffic Server is affected by CVE-2024-53868: request smuggling when chunked messages are malformed. Affected versions are 9.2.0–9.2.9 and 10.0.0–10.0.4. The issue is mitigated by upgrading to 9.2.10 or 10.0.5, which contain the fix. Impact is described as high (I), with no confidentiality...

PT-2025-14780 · Projeqtor · Projeqtor

Name of the Vulnerable Software and Affected Versions: Projeqtor versions up to 12.0.2 Description: A critical issue affects some unknown functionality of the file /tool/saveAttachment.php, where the manipulation of the attachmentFiles argument leads to unrestricted upload. The attack can be...

CVE-2025-1734 affecting package php for versions less than 8.3.19-1

CVE-2025-1734 affecting package php for versions less than 8.3.19-1. An upgraded version of the package is available that resolves this issue...

Security update for warewulf4

This update for warewulf4 fixes the following issues: warewulf4 was updated from version 4.5.8 to 4.6.0: Security issues fixed for version 4.6.0: CVE-2025-22869: Fixed Denial of Service vulnerability in the Key Exchange of golang.org/x/crypto/ssh bsc1239322 CVE-2025-22870: Fixed proxy bypass usin...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation due to the handling of the PROXY command. An attacker can spoof their IP address by sending multiple PROXY commands, with later ones overriding earlier ones. Note: This is only exploitable if ProxyOn is enabled...

CVE-2025-1734 affecting package php for versions less than 8.1.32-1

CVE-2025-1734 affecting package php for versions less than 8.1.32-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-45338 affecting package packer for versions less than 1.9.5-7

CVE-2024-45338 affecting package packer for versions less than 1.9.5-7. An upgraded version of the package is available that resolves this issue...

Private Data Structure Returned From A Public Method

Overview Affected versions of this package are vulnerable to Private Data Structure Returned From A Public Method. When a user accesses an externally referenced image, the provider of the image may obtain private information about the IP address of that accessing user. Remediation Upgrade...

Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue...

GHSA-WQCC-MFHW-53PC Apache Answer User Using External Images Potentially Discloses User Information

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of th...

CVE-2025-29868

CVE-2025-29868 affects Apache Answer up to version 1.4.2. A public method returns a private data structure, enabling potential disclosure of a user’s IP address when external images are accessed. The issue is mitigated in version 1.4.5, which adds a configurable setting to control whether externa...

CVE-2025-29868 Apache Answer: Using externally referenced images can leak user privacy.

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of th...

CVE-2025-30065 Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue...