CVE-2024-22393

Apache Answer versions up to 1.2.1 are vulnerable to a Pixel Flood (or Image Dimension DoS) attack. A logged-in user can trigger a Denial of Service by uploading a small image (e.g., ~5KB) with falsified EXIF metadata declaring massive dimensions (such as 64,250 x 64,250 pixels). When the server ...

CVE-2024-45719

Apache Answer versions through 1.4.0 are affected by an Inadequate Encryption Strength vulnerability. The root cause is the use of UUID v1 to generate identifiers, which are not sufficiently secure and can result in predictable tokens . Users are recommended to upgrade to version 1.4.1 to resolve...

CVE-2026-60053

The Apache Answer software (through version 2.0.1 ) is vulnerable to an insufficient session expiration issue. This flaw allows administrative API keys to remain usable even after the owning administrator's account has been demoted, marked as inactive, suspended, or deleted. Consequently, unautho...