CVE Vulnerability Catalog

A path traversal vulnerability in the Apache Camel FTP component allows reading, deleting, or renaming files outside the configured remote directory. This is due to missing normalization and containment checks when concatenating the directory with the file name from the server's listing. It affects versions 4.0.0–4.18.4, 4.19.0–4.22.0, and the ftp, ftps, and sftp schemes.

Deserialization of untrusted data vulnerability in the Apache Camel Spring Redis component. When no serializer was configured, the component defaulted to JdkSerializationRedisSerializer without an ObjectInputFilter, allowing code execution via crafted data in Redis. Affects versions from 2.11.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components allows an inbound message sender to override the endpoint URI via the CamelHttpUri and CamelRestHttpUri headers, after which property placeholders in that string are resolved (environment variables, system properties, secret functions, bean invocations). This can lead to exposure of sensitive information and unexpected bean method invocation. The issue affects Apache Camel from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1.

A vulnerability in the Apache Camel Docling component allows implicit selection of message body processing mode based on its prefix (http://, https://, / or \), enabling SSRF, path traversal and exposure of sensitive information. The lack of an option to pin the mode and insufficient path validation allow access to remote resources or local files without deployment opt-in.

A deserialization of untrusted data vulnerability in Apache Camel affects the camel-hazelcast component. Two configuration paths (ReplicatedHazelcastAggregationRepository and client mode in HazelcastDefaultComponent) fail to apply the JavaSerializationFilterConfig, allowing an attacker to achieve remote code execution by injecting a malicious Java object into the Hazelcast cluster.

Apache Johnzon is affected by an Unsafe Reflection vulnerability — ClassConverter loads and static-initializes an attacker-named class from untrusted JSON. The issue affects versions from 1.0.0 before 2.2.0.

A vulnerability was detected in TufayelLUS TikTok-Video-Downloader-PHP up to commit c4230497bb23dd9c1f81456fe8a982d951feac0d in unknown functionality of index.php within the TLS handler component. Manipulation leads to improper certificate validation, and the attack can be launched remotely, though it requires high complexity and is difficult to exploit. A patch is available in commit 64c0155abb88e714198241d41b918cefc0d5a42a.

A vulnerability was found in GlitterWare Passy up to 1.10.1 in the MyHttpOverrides function of lib/main.dart within the TLS handler component. Manipulation leads to improper certificate validation, and the attack may be launched remotely, though it is characterized by high complexity and difficult exploitability. Upgrading to version 1.10.2 fixes the issue (patch 3d48df7cce05e39fa4de1e42768492307f26882e).

A flaw was found in eremef bandcamp-player up to 1.8.33-beta in an unknown function of database.ts in the Remote Control Server component. Manipulating the remoteEnabled argument can lead to missing authentication, and the attack may be launched remotely. Upgrading to 1.8.34-beta resolves the issue.

A vulnerability was found in f3-factory fatfree-core up to 3.9.2 in the _curl function of web.php within the HTTP client component. Manipulation leads to improper certificate validation, and the attack may be performed remotely, though it is highly complex and difficult to exploit. Upgrading to version 3.9.3 resolves the issue (patch a2c755c8dc9ad0eb7d5fd261b09aff90f649433c).

Apache Answer through 2.0.2 has a missing authentication for critical function vulnerability. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.

Apache Answer through 2.0.2 has an incorrect implementation of authentication algorithm vulnerability. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.

Apache Answer through 2.0.2 has a missing authorization checks vulnerability. Authenticated users could perform actions on non-public content they were not permitted to access.

Apache Answer through 2.0.2 has an insufficient session expiration vulnerability. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.

Apache Answer through 2.0.2 has an exposure of sensitive information through data queries vulnerability. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.

In Apache Answer through 2.0.2, unauthenticated attackers could access comments associated with non-public content through public user profiles. The flaw stems from insufficient visibility checks on comments.

In Apache Answer through 2.0.2, unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. This is an exposure of sensitive information to unauthorized actors.

In Apache Answer through 2.0.2, an authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.

In Apache Answer through 2.0.2, an unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.

In Apache Answer through 2.0.2, a verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.