https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 17:33:53 +0000 https://cve.radiocsirt.org/vuln/cve-2025-59302 <p><strong>Affected:</strong> Apache Software Foundation Apache CloudStack</p> <p>In Apache CloudStack improper control of generation of code (&#39;Code Injection&#39;) vulnerability is found in the following APIs which are accessible only to admins.</p> <p>* quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage</p> <p>This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.</p> <p>The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache CloudStack</p> <p>In Apache CloudStack improper control of generation of code (&#39;Code Injection&#39;) vulnerability is found in the following APIs which are accessible only to admins.</p> <p>* quotaTariffCreate * quotaTariffUpdate * createSecondaryStorageSelector * updateSecondaryStorageSelector * updateHost * updateStorage</p> <p>This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.</p> <p>The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.</p> https://cve.radiocsirt.org/vuln/cve-2025-59302