deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-21855
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

ibmvnic: Don't reference skb after sending to VIOS

Previously, after successfully flushing the xmit buffer to VIOS,
the tx_bytes stat was incremented by the length of the skb.

It is invalid to access the skb memory after sending the buffer to
the VIOS because, at any point after sending, the VIOS can trigger
an interrupt to free this memory. A race between reading skb->len
and freeing the skb is possible (especially during LPM) and will
result in use-after-free:
 ==================================================================
 BUG: KASAN: slab-use-after-free in ibmvnic_xmit+0x75c/0x1808 [ibmvnic]
 Read of size 4 at addr c00000024eb48a70 by task hxecom/14495
 <...>
 Call Trace:
 [c000000118f66cf0] [c[PII_REDACTED]cba6c] dump_stack_lvl+0x84/0xe8 (unreliable)
 [c000000118f66d20] [c[PII_REDACTED]f0080] print_report+0x1a8/0x7f0
 [c000000118f66df0] [c[PII_REDACTED]f08f0] kasan_report+0x128/0x1f8
 [c000000118f66f00] [c[PII_REDACTED]f2868] __asan_load4+0xac/0xe0
 [c000000118f66f20] [c[PII_REDACTED]eac84] ibmvnic_xmit+0x75c/0x1808 [ibmvnic]
 [c000000118f67340] [c[PII_REDACTED]be168] dev_hard_start_xmit+0x150/0x358
 <...>
 Freed by task 0:
 kasan_save_stack+0x34/0x68
 kasan_save_track+0x2c/0x50
 kasan_save_free_info+0x64/0x108
 __kasan_mempool_poison_object+0x148/0x2d4
 napi_skb_cache_put+0x5c/0x194
 net_tx_action+0x154/0x5b8
 handle_softirqs+0x20c/0x60c
 do_softirq_own_stack+0x6c/0x88
 <...>
 The buggy address belongs to the object at c00000024eb48a00 which
  belongs to the cache skbuff_head_cache of size 224
==================================================================
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/093b0e5c[PII_REDACTED]3f300b908b741622eef597; https://git.kernel.org/stable/c/25dddd01dcc8ef3acff964dbb32eeb0d89f098e9; https://git.kernel.org/stable/c/501ac6a7e21b82e05207c6b4449812d82820f306
CVE: CVE-2025-21856
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/ism: add release function for struct device

According to device_release() in /drivers/base/core.c,
a device without a release function is a broken device
and must be fixed.

The current code directly frees the device after calling device_add()
without waiting for other kernel parts to release their references.
Thus, a reference could still be held to a struct device,
e.g., by sysfs, leading to potential use-after-free
issues if a proper release function is not set.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/0505ff2936f166405d81d0d454a81d9c14124344; https://git.kernel.org/stable/c/915e34d5ad35a6a9e56113f852ade4a730fb88f0; https://git.kernel.org/stable/c/940d15254d2216b585558bcf36312da50074e711
CVE: CVE-2025-21857
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: fix error handling causing NULL dereference

tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can
return 1 if the allocation succeeded after wrapping. This was treated as
an error, with value 1 returned to caller tcf_exts_init_ex() which sets
exts->actions to NULL and returns 1 to caller fl_change().

fl_change() treats err == 1 as success, calling tcf_exts_validate_ex()
which calls tcf_action_init() with exts->actions as argument, where it
is dereferenced.

Example trace:

BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
CPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1
RIP: 0010:tcf_action_init+0x1f8/0x2c0
Call Trace:
 tcf_action_init+0x1f8/0x2c0
 tcf_exts_validate_ex+0x175/0x190
 fl_change+0x537/0x1120 [cls_flower]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/071ed42cff4fcdd89025d966d48eabef59913bf2; https://git.kernel.org/stable/c/3c74b5787caf59bb1e9c5fe0a360643a71eb1e8a; https://git.kernel.org/stable/c/3e4c56cf41876ef2a82f0877fe2a67648f8632b8
CVE: CVE-2025-21859
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: f_midi: f_midi_complete to call queue_work

When using USB MIDI, a lock is attempted to be acquired twice through a
re-entrant call to f_midi_transmit, causing a deadlock.

Fix it by using queue_work() to schedule the inner f_midi_transmit() via
a high priority work queue from the completion handler.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/1f[PII_REDACTED]a94891e612dff3b75e828a78368; https://git.kernel.org/stable/c/24a942610ee9bafb2692a456ae850c5b2e409b05; https://git.kernel.org/stable/c/4ab37fcb42832cdd3e9d5e50653285ca84d6686f
CVE: CVE-2025-21860
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/zswap: fix inconsistency when zswap_store_page() fails

Commit b7c0ccdfbafd ("mm: zswap: support large folios in zswap_store()")
skips charging any zswap entries when it failed to zswap the entire folio.

However, when some base pages are zswapped but it failed to zswap the
entire folio, the zswap operation is rolled back.  When freeing zswap
entries for those pages, zswap_entry_free() uncharges the zswap entries
that were not previously charged, causing zswap charging to become
inconsistent.

This inconsistency triggers two warnings with following steps:
  # On a machine with 64GiB of RAM and 36GiB of zswap
  $ stress-ng --bigheap 2 # wait until the OOM-killer kills stress-ng
  $ sudo reboot

  The two warnings are:
    in mm/memcontrol.c:163, function obj_cgroup_release():
      WARN_ON_ONCE(nr_bytes & (PAGE_SIZE - 1));

    in mm/page_counter.c:60, function page_counter_cancel():
      if (WARN_ONCE(new < 0, "page_counter underflow: %ld nr_pages=%lu\n",
	  new, nr_pages))

zswap_stored_pages also becomes inconsistent in the same way.

As suggested by Kanchana, increment zswap_stored_pages and charge zswap
entries within zswap_store_page() when it succeeds.  This way,
zswap_entry_free() will decrement the counter and uncharge the entries
when it failed to zswap the entire folio.

While this could potentially be optimized by batching objcg charging and
incrementing the counter, let's focus on fixing the bug this time and
leave the optimization for later after some evaluation.

After resolving the inconsistency, the warnings disappear.

[42.hyeyoo@gmail.com: refactor zswap_store_page()]
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/63895d20d63b446f5049a[PII_REDACTED]19c2ea3e2; https://git.kernel.org/stable/c/a3652f5552b[PII_REDACTED]2da487a7be2b95394d5
CVE: CVE-2025-21862
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: fix incorrect initialization order

Syzkaller reports the following bug:

BUG: spinlock bad magic on CPU#1, syz-executor.0/7995
 lock: 0xffff88805303f3e0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
CPU: 1 PID: 7995 Comm: syz-executor.0 Tainted: G            E     5.10.209+ #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x119/0x179 lib/dump_stack.c:118
 debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]
 do_raw_spin_lock+0x1f6/0x270 kernel/locking/spinlock_debug.c:112
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]
 _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159
 reset_per_cpu_data+0xe6/0x240 [drop_monitor]
 net_dm_cmd_trace+0x43d/0x17a0 [drop_monitor]
 genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2497
 genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
 netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1348
 netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec net/socket.c:651 [inline]
 __sock_sendmsg+0x157/0x190 net/socket.c:663
 ____sys_sendmsg+0x712/0x870 net/socket.c:2378
 ___sys_sendmsg+0xf8/0x170 net/socket.c:2432
 __sys_sendmsg+0xea/0x1b0 net/socket.c:2461
 do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x62/0xc7
RIP: 0033:0x7f3f9815aee9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3f972bf0c8 EFLAGS: 00000246 ORIG_RAX:[PII_REDACTED]00002e
RAX: ffffffffffffffda RBX: 00007f3f9826d050 RCX: 00007f3f9815aee9
RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
RBP: 00007f3f981b63bd R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: [PII_REDACTED]
R13:[PII_REDACTED]00006e R14: 00007f3f9826d050 R15: 00007ffe01ee6768

If drop_monitor is built as a kernel module, syzkaller may have time
to send a netlink NET_DM_CMD_START message during the module loading.
This will call the net_dm_monitor_start() function that uses
a spinlock that has not yet been initialized.

To fix this, let's place resource initialization above the registration
of a generic netlink family.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/07b598c0e6f06a0f254c88dafb4ad50f8a8c6eea; https://git.kernel.org/stable/c/0efa6c42f81c60d8f72ba7f5ed8d4fec8c526282; https://git.kernel.org/stable/c/219a47d0e6195bd202f22855e35f25bd15bc4d58
CVE: CVE-2025-21863
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: prevent opcode speculation

sqe->opcode is used for different tables, make sure we santitise it
against speculations.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/1e988c3fe1264708f4f92109203ac5b1d65de50b; https://git.kernel.org/stable/c/506b9b5e8c2d2a411ea8fe361333f5081c56d23a; https://git.kernel.org/stable/c/b9826e3b26ec031e9063f64a7c735449c43955e4
CVE: CVE-2025-21864
Published: 2025-03-12
Description: In the Linux kernel, the following vulnerability has been resolved:

tcp: drop secpath at the same time as we currently drop dst

Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while
running tests that boil down to:
 - create a pair of netns
 - run a basic TCP test over ipcomp6
 - delete the pair of netns

The xfrm_state found on spi_byaddr was not deleted at the time we
delete the netns, because we still have a reference on it. This
lingering reference comes from a secpath (which holds a ref on the
xfrm_state), which is still attached to an skb. This skb is not
leaked, it ends up on sk_receive_queue and then gets defer-free'd by
skb_attempt_defer_free.

The problem happens when we defer freeing an skb (push it on one CPU's
defer_list), and don't flush that list before the netns is deleted. In
that case, we still have a reference on the xfrm_state that we don't
expect at this point.

We already drop the skb's dst in the TCP receive path when it's no
longer needed, so let's also drop the secpath. At this point,
tcp_filter has already called into the LSM hooks that may require the
secpath, so it should not be needed anymore. However, in some of those
places, the MPTCP extension has just been attached to the skb, so we
cannot simply drop all extensions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/69cafd9413084cd5012cf5d7c7ec6f3d493726d9; https://git.kernel.org/stable/c/87858bbf21da239ace300d61dd209907995c0491; https://git.kernel.org/stable/c/9b6412e6979f6f9e0632075f8f008937b5cd4efd
CVE: CVE-2025-2239
Published: 2025-03-12
Description: Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://www.hillstonenet.com.cn/security-notification/2025/02/17/stoneosjd/
CVE: CVE-2024-13870
Published: 2025-03-12
Description: An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-1328
References: https://bitdefender.com/support/security-advisories/unauthenticated-firmware-downgrade-in-bitdefender-box-v1
CVE: CVE-2024-13871
Published: 2025-03-12
Description: A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://bitdefender.com/support/security-advisories/unauthenticated-command-injection-in-bitdefender-box-v1
CVE: CVE-2024-13872
Published: 2025-03-12
Description: Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API method. Then, an unauthenticated and network-adjacent attacker can use man-in-the-middle (MITM) techniques to return malicious responses. Restarted daemons that use malicious assets can then be exploited for remote code execution on the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://bitdefender.com/support/security-advisories/insecure-update-mechanism-vulnerability-in-libboxhermes-so-in-bitdefender-box-v1
CVE: CVE-2025-1527
Published: 2025-03-12
Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3253711/woolentor-addons/trunk/includes/modules/flash-sale/assets/js/flash-sale.js; https://www.wordfence.com/threat-intel/vulnerabilities/id/d3405b50-a3f0-4280-8a34-ed86ce3d4db4?source=cve
CVE: CVE-2024-10838
Published: 2025-03-12
Description: An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of service conditions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-191
References: https://github.com/eclipse-cyclonedds/cyclonedds/releases/tag/0.10.5; https://github.com/eclipse-cyclonedds/cyclonedds/security/advisories/GHSA-6jj6-w25p-jc42; https://gitlab.eclipse.org/security/cve-assignement/-/issues/46
CVE: CVE-2025-29903
Published: 2025-03-12
Description: In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-426
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2025-29904
Published: 2025-03-12
Description: In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: https://www.jetbrains.com/privacy-security/issues-fixed/
CVE: CVE-2024-52362
Published: 2025-03-12
Description: IBM App Connect Enterprise Certified Container 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, and 12.8 could allow an authenticated user to cause a denial of service in the App Connect flow due to improper validation of server-side input.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1286
References: https://www.ibm.com/support/pages/node/7185527
CVE: CVE-2025-21590
Published: 2025-03-12
Description: An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.

A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device.
This issue is not exploitable from the Junos CLI.
This issue affects Junos OS: 



  *  All versions before 21.2R3-S9,
  *  21.4 versions before 21.4R3-S10, 
  *  22.2 versions before 22.2R3-S6, 
  *  22.4 versions before 22.4R3-S6, 
  *  23.2 versions before 23.2R2-S3, 
  *  23.4 versions before 23.4R2-S4,
  *  24.2 versions before 24.2R1-S2, 24.2R2.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-653
References: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers; https://supportportal.juniper.net/JSA93446; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21590
CVE: CVE-2025-25709
Published: 2025-03-12
Description: An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the addUser and updateUser endpoints
CVSS Score: 7.5 (HIGH)
References: https://github.com/z5jt/vulnerability-research/tree/main/CVE-2025-25709
CVE: CVE-2025-27788
Published: 2025-03-12
Description: JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/ruby/json/commit/c56db31f800d5d508389793e69682f99749dbadf; https://github.com/ruby/json/releases/tag/v2.10.2; https://github.com/ruby/json/security/advisories/GHSA-9m3q-rhmv-5q44
CVE: CVE-2025-27794
Published: 2025-03-12
Description: Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74
References: https://github.com/flarum/framework/commit/a05aaea3ee1e0a8b[PII_REDACTED]93cd6052f1d402; https://github.com/flarum/framework/releases/tag/v1.8.10; https://github.com/flarum/framework/security/advisories/GHSA-hg9j-64wp-m9px
CVE: CVE-2024-27763
Published: 2025-03-12
Description: XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in the presence of a crafted SLURM_NODELIST environment variable.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-77
References: https://gist.github.com/aydinnyunus/40e1d8a3b529261ae654ff4891f1e192; https://github.com/XPixelGroup/BasicSR/blob/master/basicsr/utils/dist_util.py#L44
CVE: CVE-2025-22954
Published: 2025-03-12
Description: GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89
References: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38829; https://koha-community.org/koha-24-11-02-released/
CVE: CVE-2025-27914
Published: 2025-03-12
Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
CVE: CVE-2025-27915
Published: 2025-03-12
Description: An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wiki.zimbra.com/wiki/Security_Center; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes
CVE: CVE-2025-29891
Published: 2025-03-12
Description: Bypass/Injection vulnerability in Apache Camel.

This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4.

Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.

This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component.

If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get translated into headers. 

The headers could be both provided as request parameters for an HTTP methods invocation or as part of the payload of the HTTP methods invocation.

All the known Camel HTTP component such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http would be vulnerable out of the box.

This CVE is related to the CVE-2025-27636: while they have the same root cause and are fixed with the same fix, CVE-2025-27636 was assumed to only be exploitable if an attacker could add malicious HTTP headers, while we have now determined that it is also exploitable via HTTP parameters. Like in CVE-2025-27636, exploitation is only possible if the Camel route uses particular vulnerable components.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-164
References: https://camel.apache.org/security/CVE-2025-27636.html; https://camel.apache.org/security/CVE-2025-29891.html; https://github.com/akamai/CVE-2025-27636-Apache-Camel-PoC