CVE-2025-54309

CVE-2025-54309 CrushFTP Authentication Bypass Overview CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP that allows unauthorized administrative user creation through AS2 header manipulation. Technical Details Vulnerability Location File : crushftp/server/ServerSessionHTTP.java...

CrushFTP-AS2-Bypass-Research-CVE-2025-54309

CrushFTP AS2 Authentication Bypass Research ⚠️ IMPORTANT: This vulnerability has been patched by CrushFTP as of November 2025. This research is published for educational and defensive purposes only. 📝 NOTE: This research is based on vulnerability patterns similar to CVE-2025-54309. The exact CVE...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-97873 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-97873 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20536965...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-18036 via org.bouncycastle:bcprov-debug-jdk18on (>=1.74, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.74, =4.7.0, =4.7.0, =3.0.0-rc1, =3.0.0-rc1, =3.2.0, =3.20.7, =3.20.7, =3.20.7, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-18036 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-20419433...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-17508 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.85)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.85 and more Source cves: CVE-2026-17508 Source advisory: MEND:CVE-2026-17508...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-58059 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-58059 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518046...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-12816 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-12816 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519166...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-12860 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-12860 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518021...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-58062 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-58062 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519197...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-58061 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-58061 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519130...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-58063 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-58063 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519074...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-13506 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-13506 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519017...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-12185 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-12185 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512524...

de.gematik.ti:vauchannel-client (1.4.0), de.gematik.ti:vauchannel-cxf (1.4.0) +5 more potentially affected by CVE-2026-59645 via org.bouncycastle:bcprov-debug-jdk15on (1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version 1.70 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcprov-debug-jdk15on and may be impacted: - de.gematik.ti:vauchannel-client 1.4.0 - de.gematik.ti:vauchannel-cxf 1.4.0 -...

io.github.jinahya:jinahya-bcprov (0.0.1), org.apache.camel.karaf:camel-as2 (>=4.7.0, <=4.10.7) +14 more potentially affected by CVE-2026-59650 via org.bouncycastle:bcprov-debug-jdk18on (>=1.71, <=1.83)

org.bouncycastle:bcprov-debug-jdk18on MAVEN version =1.71, =4.7.0, =4.7.0, =3.0.0-m1, =3.0.0-m1, =3.2.0, =3.18.0, =3.18.0, =3.18.0, =1.81, =1.81, =1.81, =1.81, =1.81, =1.81, =1.83 and more Source cves: CVE-2026-59650 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512814...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

Progress MOVEit Transfer 2023.0.x / 2023.1.x < 2023.1.16 / 2024.0.x / 2024.1.x < 2024.1.7 / 2025.0.x < 2025.0.3 Uncontrolled Resource Consumption (October 2025)

The version of Progress MOVEit Transfer, formerly Ipswitch MOVEit DMZ, installed on the remote host is affected by an uncontrolled resource consumption vulnerability as referenced in Progress Community article 000291424. - Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfe...

CVE-2021-33576

An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk...

CVE-2021-33577

An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves via encryption and signing of the message can be bypassed by changing the Content-Type of the message to text/plain...