Threats tagged 'maven'

A critical XML External Entity (XXE) vulnerability exists in Apache Tika's tika-parser-pdf-module versions 1.13 through 3.2.1. This flaw allows attackers to exploit crafted XFA files inside PDFs to perform XXE injection, potentially leading to sensitive data disclosure or malicious requests to internal or external servers. The vulnerability affects multiple Tika packages that depend on this module. Upgrading to version 3.2.2 or 2.0.0-ALPHA resolves the issue.

CVE-2025-5115, known as the MadeYouReset vulnerability, is a denial of service flaw in the HTTP/2 protocol affecting the Eclipse Jetty http2-common library. It exploits a design issue where the server incorrectly counts active streams when streams are reset, allowing an attacker to exhaust server resources by repeatedly triggering stream resets via malformed HTTP/2 control frames. This leads to CPU or memory exhaustion, causing service disruption. The vulnerability affects multiple Jetty versions prior to fixed releases and has a CVSS score of 7.5 (high severity).

CVE-2025-55163, known as the MadeYouReset vulnerability, is a logical flaw in the HTTP/2 protocol affecting io.netty:netty-codec-http2. It exploits malformed HTTP/2 control frames to bypass the max concurrent streams limit, causing resource exhaustion and denial of service. The attack triggers the server to reset streams prematurely, allowing an attacker to open an unbounded number of concurrent streams. This leads to CPU overload or memory exhaustion depending on the implementation. The vulnerability affects multiple versions of the Netty HTTP/2 codec and has a high severity rating with a CVSS score of 7.5. A patch is available in versions 4.2.4.Final, 4.1.124.Final, and 1.75.0.

Apache Seata version 2.4.0 contains a deserialization of untrusted data vulnerability. This flaw allows an attacker to exploit unsafe deserialization, potentially leading to critical impacts. The issue is resolved in version 2.5.0, and users are advised to upgrade to this fixed release.

ExecuTorch versions prior to 0.7.0 contain heap-based buffer overflow vulnerabilities in the model loading process. These vulnerabilities can cause the runtime to crash and may allow code execution or other harmful effects. The issue is fixed in version 0.7.0.

An integer overflow vulnerability in ExecuTorch versions prior to 0.7.0 can cause overlapping memory allocations when loading models. This flaw may lead to arbitrary code execution or other severe impacts. The vulnerability is identified as CVE-2025-30404 and has a critical severity rating with a CVSS score of 9.8. A fix is available in ExecuTorch version 0.7.0.

An out-of-bounds access vulnerability in ExecuTorch versions prior to 0.7.0 can cause the runtime to crash and may lead to code execution or other harmful effects. This critical vulnerability is identified as CVE-2025-54950 and has a high CVSS score of 9.8. The issue is fixed in version 0.7.0.

ExecuTorch versions prior to 0.7.0 contain a heap buffer overflow vulnerability in the model loading component. This flaw can lead to remote code execution or other severe impacts. The vulnerability is tracked as CVE-2025-54949 and has a critical CVSS score of 9.8. A fix is available in version 0.7.0.

An integer overflow vulnerability in ExecuTorch prior to version 0.7.0 allows improper memory handling during model loading, which can lead to code execution or other harmful effects. This critical flaw has a CVSS score of 9.8 and is fixed in version 0.7.0.

Apache Zeppelin versions from 0.11.1 up to but not including 0.12.0 contain a vulnerability due to missing origin validation in WebSockets. This flaw allows an attacker to access the Zeppelin server from an unauthorized origin and retrieve internal information about paragraphs. The issue is fixed in version 0.12.0.

Apache Zeppelin before version 0.12.0 contains a Cross-Site Scripting (XSS) vulnerability in its Helium module due to an incomplete blacklist. This flaw allows attackers to inject malicious scripts, potentially impacting confidentiality and integrity. The issue is fixed in version 0.12.0, which users are advised to upgrade to.

Apache Zeppelin versions from 0.11.1 up to but not including 0.12.0 contain an improper input validation vulnerability related to JDBC URL handling. This flaw allows an attacker to perform arbitrary file reads by exploiting URL encoded input that bypasses previous validation fixes. The issue is resolved in version 0.12.0.

Apache JSPWiki versions prior to 2.12.3 contain a cross-site scripting (XSS) vulnerability in the Image plugin. This flaw allows an attacker to execute arbitrary JavaScript in the context of a victim's browser, potentially exposing sensitive information. Users are advised to upgrade to version 2.12.3 or later to remediate this issue.

Apache JSPWiki versions prior to 2.12.3 contain a Cross-Site Scripting (XSS) vulnerability that can be triggered via crafted header link markup or markdown parsing. This flaw allows attackers to execute arbitrary JavaScript in the victim's browser, potentially exposing sensitive information. The issue is fixed in version 2.12.3.

Apache Jena versions up to 5.4.0 contain a vulnerability where file access paths in configuration files uploaded by users with administrator privileges are not validated. This flaw allows potentially harmful file access through crafted configuration uploads. The issue is resolved in version 5.5.0, which disallows arbitrary configuration uploads.

Apache Jena Fuseki versions prior to 5.5.0 contain a vulnerability that allows users with administrator privileges to create database files outside the designated files area of the Fuseki server. This directory traversal issue could lead to unauthorized file creation in unintended locations. The vulnerability has a CVSS score of 4.9, indicating medium severity. The issue is fixed in version 5.5.0.

CVE-2025-7789 is a vulnerability in the token generation function of Xuxueli xxl-job admin versions prior to 3.2.0. The flaw involves inadequate encryption strength in password hashing, resulting in insufficient computational effort to protect passwords. The vulnerability can be exploited remotely but requires high attack complexity and no privileges or user interaction. A fix is available in version 3.2.0.

Apache CXF versions prior to 3.5.11, between 3.6.0 and 3.6.6, between 4.0.0 and 4.0.7, and between 4.1.0 and 4.1.1 have a vulnerability where large temporary files are fully read into memory and logged unencrypted. This can lead to denial of service via out of memory exceptions and exposure of sensitive data in logs. Fixed versions are 3.5.11, 3.6.6, 4.0.7, and 4.1.1.

Apache Jackrabbit versions prior to 2.20.17, 2.22.1, and 2.23.2-beta contain a blind XML External Entity (XXE) vulnerability in the jackrabbit-spi-commons and jackrabbit-core components. This vulnerability arises from the use of an insecure document builder to load privileges. It allows an attacker with low privileges to cause high impact including confidentiality, integrity, and availability compromise. Users are advised to upgrade to the fixed versions to mitigate this issue.

Apache Zeppelin versions from 0.10.1 up to but not including 0.12.0 contain a vulnerability in the raft server protocol that allows unauthenticated attackers to access server resources such as directories and files. This issue is fixed in version 0.12.0 by removing the Cluster Interpreter component.