CVE-2024-13941

CVE-2024-13941 affects ouch-org/ouch up to version 0.3.1. The vulnerability is in ouch::archive::zip::convert_zip_date_time (zip.rs) where manipulating the month parameter leads to memory corruption. Attack requires local access; exploit was disclosed publicly. Upgrading to 0.4.0 mitigates the is...

CVE-2024-13941 ouch-org ouch zip.rs convert_zip_date_time memory corruption

A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convertzipdatetime of the file zip.rs. The manipulation of the argument month leads to memory corruption. The attack needs to be approached locally. The exploi...

CVE-2024-13941 ouch-org ouch zip.rs convert_zip_date_time memory corruption

A vulnerability was found in ouch-org ouch up to 0.3.1. It has been classified as critical. This affects the function ouch::archive::zip::convertzipdatetime of the file zip.rs. The manipulation of the argument month leads to memory corruption. The attack needs to be approached locally. The exploi...

CVE-2025-30676 Apache OFBiz: Stored XSS Vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue...

CVE-2025-30676 Apache OFBiz: Stored XSS Vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue...

Apache Camel Missing Header Out Filter Leads to Potential Bypass/Injection Vulnerability

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow...

CVE-2025-30177 Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering

Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. Users are recommended to upgrade to version 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. Camel undertow...

Security Bulletin: A security vulnerability was identified in IBM Jazz Reporting Service (CVE-2024-25051)

Summary A security vulnerability was identified in IBM Jazz Reporting Service, where user sessions are not properly invalidated after logout. Vulnerability Details CVEID:CVE-2024-25051 DESCRIPTION: IBM Jazz Reporting Service does not invalidate session after logout which could allow an...

Security Bulletin: There is a vulnerability in kafka-clients-3.6.0.jar used by IBM Maximo Asset Management application (CVE-2024-31141)

Summary There is a vulnerability in kafka-clients-3.6.0.jar used by IBM Maximo Asset Management application CVE-2024-31141 Vulnerability Details CVEID:CVE-2024-31141 DESCRIPTION: Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka...

CVE-2025-29868

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of th...

CVE-2025-29868

CVE-2025-29868 affects Apache Answer up to version 1.4.2. A public method returns a private data structure, enabling potential disclosure of a user’s IP address when external images are accessed. The issue is mitigated in version 1.4.5, which adds a configurable setting to control whether externa...

CVE-2025-29868 Apache Answer: Using externally referenced images can leak user privacy.

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of th...

DoS (Denial of Service) net.minidev:json-smart Dependency in Bamboo Data Center and Server

This High severity net.minidev:json-smart Dependency vulnerability was introduced in versions 9.6.0, 10.0.0-rc5, 10.1.0, and 10.2.0 of Bamboo Data Center and Server. This net.minidev:json-smart Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

PT-2025-14441 · Onlyoffice · Onlyoffice Document Server

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Document Server versions 7.5.0 and earlier Description: The issue allows a remote attacker to obtain sensitive information via a crafted file upload. This is a result of a Directory Traversal vulnerability. Recommendations: For...

Medium: jsoup

Issue Overview: jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck loop...

PT-2025-14385 · Unknown · Animesh Kumar Advanced Speed Increaser

Name of the Vulnerable Software and Affected Versions: Animesh Kumar Advanced Speed Increaser versions n/a through 2.2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

PT-2025-14172 · Unknown · Travis Simple Icons

Name of the Vulnerable Software and Affected Versions: Travis Simple Icons versions through 2.8.4 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions through 2.8.4,...

PT-2025-14076 · Unknown · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart versions 3.4.10 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially be exploited, but no specific details about the estimated number of...

PT-2025-14144 · Unknown · Tz Plusgallery

Name of the Vulnerable Software and Affected Versions: TZ PlusGallery versions 1.5.5 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. Recommendations: For versions 1.5.5 and earlier, update to a version...

PT-2025-14423 · Unknown · Salesmate Add-On For Gravity Forms

Name of the Vulnerable Software and Affected Versions: Salesmate Add-On for Gravity Forms versions n/a through 2.0.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...