Apache Parquet Java Vulnerability Let Attackers Execute Arbitrary Code

Apache Parquet Java Vulnerability Let Attackers Execute Arbitrary Code

A new critical security vulnerability in Apache Parquet Java has been disclosed that could allow attackers to execute arbitrary code through specially crafted Parquet files.
The vulnerability, tracked …
Read more

Published Date:
May 05, 2025 (5 hours, 8 minutes ago)

Vulnerabilities has been mentioned in this article.

Read More

CVE-2025-4271 – TOTOLINK A720R CGI Argument Injection Information Disclosure

CVE ID : CVE-2025-4271

Published : May 5, 2025, 8:15 a.m. | 3 hours, 24 minutes ago

Description : A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Severity: 5.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More

CVE-2025-4270 – TOTOLINK A720R CGI Config Handler Information Disclosure

CVE ID : CVE-2025-4270

Published : May 5, 2025, 8:15 a.m. | 3 hours, 24 minutes ago

Description : A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity: 5.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More

CVE-2025-2905 – WSO2 API Manager XXE File Disclosure and Denial of Service Vulnerability

CVE ID : CVE-2025-2905

Published : May 5, 2025, 9:15 a.m. | 2 hours, 24 minutes ago

Description : An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.

This vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks.

*
On systems running JDK 7 or early JDK 8, full file contents may be exposed.

*
On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.

*
DoS attacks such as “Billion Laughs” payloads can cause service disruption.

Severity: 9.1 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More