CVE-2025-39491

Google Cloud Application Integration versions prior to 2026-06-28 contain a Deserialization of Untrusted Data vulnerability in the JavaScript task. An authenticated user with standard permissions can run arbitrary code on shared production servers by bypassing parameter guards with a specially crafted script.

Google Cloud Application Integration versions prior to 2026-06-17 contain an Incorrect Authorization vulnerability in task configuration. An authenticated Google Cloud user can execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type.

A vulnerability was identified in FAST FAC1900R version 20190827_2.0.2.2 in the copy_msg_element function of the devdiscover Service component. Manipulation leads to a stack-based buffer overflow, and the attack can be executed remotely. The exploit is publicly available and may be used; the vendor did not respond to the disclosure.

A vulnerability was determined in FAST FAC1200R version 5.0_20201119_1.0.2 in the MmtAtePrase function of the MmtAtePrase Parser component. Manipulation causes a stack-based buffer overflow, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.

A vulnerability was found in FAST FAC1200R version 5.0_20201119_1.0.2 in the parse_advertisement_frame function of the devdiscover Service component. Manipulation results in a stack-based buffer overflow, and the attack may be launched remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.

Apache Roller 6.1.5 contains a Deserialization of Untrusted Data vulnerability because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is disabled; no non-default configuration is required. This can lead to remote code execution.

Apache Roller 6.1.5 contains an Incorrect Authorization vulnerability in the OAuth 1.0a authorization endpoint. An unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer can bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session.

Apache Roller 6.1.5 contains a Missing Authorization vulnerability that allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs. The handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected. Only installations that enable the non-default global XML-RPC setting are affected; the per-weblog API flag defaults to enabled for UI-created weblogs.

A vulnerability was found in aaPanel BaoTa up to version 11.8.0 in the merge_split_file function of the file /www/server/panel/class/files.py in the File Merge Handler component. Manipulation of the split_file_path argument results in command injection, and the attack can be carried out remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.

A security flaw was discovered in Netcore NBR200V2 version 1.3.241127.071246. Manipulation of the url argument in the system function of /usr/bin/network_tools within the Tools Ping Handler component results in OS command injection. The attack can be initiated remotely and the exploit has been publicly released.