In March 2025, Apache disclosed CVE-2025-24813, a vulnerability impacting Apache Tomcat. This is a widely used platform that allows Apache web servers to run Java-based web applications.
The flaw allows remote code execution, affecting Apache Tomcat versions 9.0.0.M1 to 9.0.98, 10.1.0-M1 to 10.1.34 and 11.0.0-M1 to 11.0.2. The same month, Apache revealed two additional vulnerabilities in Apache Camel, a message routing middleware framework. These vulnerabilities are CVE-2025-27636 and CVE-2025-29891, two flaws that allow remote code execution, affecting Apache Camel versions 4.10.0 to 4.10.1, 4.8.0 to 4.8.4 and 3.10.0 to 3.22.3. These vulnerabilities are significant because millions of developers rely on the platform provided by the Apache Foundation.
Read more…
Source: Palo Alto Unit 42
Sign up for the Cyber Security Review Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Pakistan: Balochistan decides to ‘restrict’ internet service in ‘sensitive polling booths’
February 5, 2024
The caretaker government in Balochistan has decided to keep the internet service restricted in the sensitive polling booths in certain areas of the province in the lead-up to the February 8 polls amid dire security risks due to a spike in terrorist attacks. Balochistan caretaker Information Minister Jan Achakzai on Sunday night announced the decision, citing ...
- Exploring the (Not So) Secret Code of Black Hunt Ransomware
February 5, 2024
It seems like every week, the cybersecurity landscape sees the emergence of yet another ransomware variant, with Black Hunt being one of the latest additions. Initially reported by cybersecurity researchers in 2022, this new threat has quickly made its presence known. In a recent incident, Black Hunt ransomware wreaked havoc by compromising around 300 companies in ...
- Classified Japanese diplomatic info leaked after Chinese cyberattacks in 2020
February 5, 2024
Classified Japanese diplomatic information was leaked following Chinese cyberattacks on the Foreign Ministry in 2020, a government source said Monday, exposing the nation’s digital vulnerability. Japan detected the large-scale attack and release of diplomatic telegrams during a period of government under then Prime Minister Shinzo Abe, the source said, but the nature of the leaked information ...
- Researchers remotely exploit devices used to manage safe aircraft landings and takeoffs
February 3, 2024
Criminals could remotely tamper with the data that apps used by airplane pilots rely on to inform safe takeoff and landing procedures, according to fresh research. In a scenario that elicits strong memories of that nail-biting flight scene from Die Hard 2, researchers investigating electronic flight bags (EFBs) found the app used by Airbus pilots was ...
- Philippines: Cyber attack on Overseas Workers Welfare Administration website foiled
February 3, 2024
The Department of Information and Communications Technology (DICT) has prevented a cyber attack aimed at taking down the website of the Overseas Workers Welfare Administration (OWWA). At the Saturday News Forum, DICT Undersecretary for Cybersecurity Jeff Ian Dy said the DICT was able to “defend” various web applications related to OWWA from cyber attacks. The DICT ...
- Europcar’s Alleged Data Breach Wasn’t Done Using AI, Experts Argue
February 2, 2024
French car rental company Europcar made headlines earlier this week following reports of an alleged data breach affecting nearly 50 million customers. Cyber security platform HackManac reported the incident on January 30th, noting that the stolen database containing usernames, passwords, full names, addresses, and several other user-identifying information had been listed for sale on a hacking ...