24h | 7d | 30d

CVE-2025-54988

Overview

  • Apache Software Foundation
  • Apache Tika PDF parser module
  • org.apache.tika:tika-parser-pdf-module
20 Aug 2025
Published
04 Nov 2025
Updated
CVSS
Pending
EPSS
0.03%
KEV

Description

Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

Statistics

  • 1 Post
Last activity: 3 hours ago

Fediverse

Profile picture
Cybersecurity & cyberwarfare @cybersecurity

Vulnerabilità critica in Apache Tika con Severity 10! rischio di attacco XXE

E’ stata pubblicata una vulnerabilità critica in Apache Tika, che potrebbe consentire un attacco di iniezione di entità esterne XML, noto come XXE. La falla di sicurezza, catalogata come CVE-2025-66516, presenta un punteggio pari a 10,0 secondo la scala CVSS, indice di massima gravità.

Si ritiene che CVE-2025-66516 sia identica al CVE-2025-54988 (punteggio CVSS: 8,4), un’altra falla XXE nel framework di rilevamento e analisi dei contenuti, corretta dai responsabili del progetto nell’agosto 2025. Il nuovo CVE, ha affermato il team di Apache Tika, amplia la portata dei pacchetti interessati in due modi.

La falla critica è presente nei moduli Apache Tika, precisamente in tika-core (dalla versione 1.13 alla 3.2.1), tika-pdf-module (dalle versioni 2.0.0 alla 3.2.1) e tika-parsers (dalla 1.13 alla 1.28.5), su tutte le piattaforme, permette ad un aggressore di effettuare iniezioni di entità esterne XML attraverso un file XFA contraffatto incluso in un PDF.

Riguarda i seguenti pacchetti Maven:

  • org.apache.tika:tika-core >= 1.13,
  • org.apache.tika:tika-parser-pdf-module >= 2.0.0,
  • org.apache.tika:tika-parsers >= 1.13,

“Innanzitutto, sebbene il punto di ingresso della vulnerabilità fosse il modulo tika-parser-pdf, come riportato in CVE-2025-54988, la vulnerabilità e la sua correzione si trovavano in tika-core”, ha affermato il team. “Gli utenti che hanno aggiornato il modulo tika-parser-pdf ma non hanno aggiornato tika-core alla versione >= 3.2.2 sarebbero comunque vulnerabili”.

Alla luce della criticità della vulnerabilità, si consiglia agli utenti di applicare gli aggiornamenti il prima possibile per mitigare le potenziali minacce.

L'articolo Vulnerabilità critica in Apache Tika con Severity 10! rischio di attacco XXE proviene da Red Hot Cyber.

  • 0
  • 0
  • 0
  • 3h ago

CVE-2025-14105

Overview

  • TOZED
  • ZLT M30S
05 Dec 2025
Published
05 Dec 2025
Updated
CVSS v4.0
MEDIUM (5.3)
EPSS
Pending
KEV

Description

A vulnerability was determined in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. This impacts an unknown function of the file /reqproc/proc_post of the component Web Interface. Executing manipulation of the argument goformId with the input REBOOT_DEVICE can lead to denial of service. The attack can only be done within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 13 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

ZSPACE

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

TOZED

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 0
  • 1
  • 0
  • 13h ago

CVE-2025-14107

Overview

  • ZSPACE
  • Q2C NAS
05 Dec 2025
Published
05 Dec 2025
Updated
CVSS v4.0
HIGH (8.7)
EPSS
Pending
KEV

Description

A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation of the argument safe_dir results in command injection. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 13 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

ZSPACE

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

TOZED

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 0
  • 1
  • 0
  • 13h ago

CVE-2025-14106

Overview

  • ZSPACE
  • Q2C NAS
05 Dec 2025
Published
05 Dec 2025
Updated
CVSS v4.0
HIGH (8.7)
EPSS
Pending
KEV

Description

A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. The manipulation of the argument safe_dir leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 13 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

ZSPACE

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

TOZED

cve.org/CVERecord?id=CVE-2025-

cc: @Dio9sys @da_667

  • 0
  • 1
  • 0
  • 13h ago

CVE-2025-55753

Overview

  • Apache Software Foundation
  • Apache HTTP Server
05 Dec 2025
Published
05 Dec 2025
Updated
CVSS
Pending
EPSS
0.01%
KEV

Description

An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Statistics

  • 1 Post
  • 5 Interactions
Last activity: 21 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

Apache HTTP Server 2.4.66 was released yesterday, patching these sev:LOW and sev:MED vulns:

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

  • 2
  • 3
  • 0
  • 21h ago

CVE-2025-66200

Overview

  • Apache Software Foundation
  • Apache HTTP Server
05 Dec 2025
Published
05 Dec 2025
Updated
CVSS
Pending
EPSS
0.02%
KEV

Description

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Statistics

  • 1 Post
  • 5 Interactions
Last activity: 21 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

Apache HTTP Server 2.4.66 was released yesterday, patching these sev:LOW and sev:MED vulns:

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

  • 2
  • 3
  • 0
  • 21h ago

CVE-2025-58098

Overview

  • Apache Software Foundation
  • Apache HTTP Server
05 Dec 2025
Published
05 Dec 2025
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Statistics

  • 1 Post
  • 5 Interactions
Last activity: 21 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

Apache HTTP Server 2.4.66 was released yesterday, patching these sev:LOW and sev:MED vulns:

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

  • 2
  • 3
  • 0
  • 21h ago

CVE-2025-65082

Overview

  • Apache Software Foundation
  • Apache HTTP Server
05 Dec 2025
Published
05 Dec 2025
Updated
CVSS
Pending
EPSS
0.02%
KEV

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.

Statistics

  • 1 Post
  • 5 Interactions
Last activity: 21 hours ago

Fediverse

Profile picture
cR0w h0 h0 @cR0w

Apache HTTP Server 2.4.66 was released yesterday, patching these sev:LOW and sev:MED vulns:

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

cve.org/CVERecord?id=CVE-2025-

  • 2
  • 3
  • 0
  • 21h ago
Showing 31 to 38 of 38 CVEs