https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:55:35 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cnvd-2018-10139 cnvd-2018-10139 https://cve.radiocsirt.org/vuln/cnvd-2018-10139 https://cve.radiocsirt.org/vuln/euvd-2026-184803 EUVD-2026-184803 https://cve.radiocsirt.org/vuln/euvd-2026-184803 https://cve.radiocsirt.org/vuln/fkie_cve-2018-1335 <p>From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.</p> <p>From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-1335 https://cve.radiocsirt.org/vuln/ghsa-9r24-gp44-h3pm <p><strong>Affected:</strong> Maven: org.apache.tika:tika-core</p> <p>From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.</p> <p><strong>Affected:</strong> Maven: org.apache.tika:tika-core</p> <p>From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.</p> https://cve.radiocsirt.org/vuln/ghsa-9r24-gp44-h3pm https://cve.radiocsirt.org/vuln/gsd-2018-1335 gsd-2018-1335 https://cve.radiocsirt.org/vuln/gsd-2018-1335 https://cve.radiocsirt.org/vuln/rhsa-2019:3140 <p>thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis thrift: Improper Access Control grants access to files outside the webservers docroot path jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class zookeeper: Information disclosure in Apache ZooKeeper</p> <p>thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis thrift: Improper Access Control grants access to files outside the webservers docroot path jackson-databind: improper polymorphic deserialization of types from Jodd-db library jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver jackson-databind: arbitrary code execution in slf4j-ext class jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes jackson-databind: improper polymorphic deserialization in axis2-transport-jms class jackson-databind: improper polymorphic deserialization in openjpa class jackson-databind: improper polymorphic deserialization in jboss-common-core class zookeeper: Information disclosure in Apache ZooKeeper</p> https://cve.radiocsirt.org/vuln/rhsa-2019:3140 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1335 <p><strong>Affected:</strong> Ubuntu:25.10: tika, Ubuntu:26.04:LTS: tika</p> <p>From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.</p> <p><strong>Affected:</strong> Ubuntu:25.10: tika, Ubuntu:26.04:LTS: tika</p> <p>From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1335