CVE Daily – Apache Ant (High+Critical) https://cvedaily.com/pages/tags/ant.html CVE Daily – Apache Ant (High+Critical) en Wed, 03 Jun 2026 21:27:04 +0000 [High] CVE-2024-35371 – Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. T... https://nvd.nist.gov/vuln/detail/CVE-2024-35371 https://nvd.nist.gov/vuln/detail/CVE-2024-35371 Fri, 29 Nov 2024 20:15:20 +0000 High CVE-2024-35371

Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions.

CVSS: 7.5 · CWE: CWE-125

View on NVD

]]> [High] CVE-2024-37779 – WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote com... https://nvd.nist.gov/vuln/detail/CVE-2024-37779 https://nvd.nist.gov/vuln/detail/CVE-2024-37779 Mon, 23 Sep 2024 20:15:04 +0000 High CVE-2024-37779

WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality.

CVSS: 8.8 · CWE: CWE-75

View on NVD

]]> [Critical] CVE-2024-46983 – sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group ... https://nvd.nist.gov/vuln/detail/CVE-2024-46983 https://nvd.nist.gov/vuln/detail/CVE-2024-46983 Thu, 19 Sep 2024 23:15:11 +0000 Critical CVE-2024-46983

sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party…

CVSS: 9.8 · CWE: CWE-74

View on NVD

]]> [High] CVE-2024-32656 – Ant Media Server is live streaming engine software. A local privilege escalation... https://nvd.nist.gov/vuln/detail/CVE-2024-32656 https://nvd.nist.gov/vuln/detail/CVE-2024-32656 Mon, 22 Apr 2024 23:15:50 +0000 High CVE-2024-32656

Ant Media Server is live streaming engine software. A local privilege escalation vulnerability in present in versions 2.6.0 through 2.8.2 allows any unprivileged operating system user account to escalate privileges to the root user account on the system. This vulnerability arises from Ant Media Server running with Java Management Extensions (JMX) enabled and authentication disabled on localhost o…

CVSS: 7.8 · CWE: CWE-862

View on NVD

]]> [Critical] CVE-2023-3651 – Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... https://nvd.nist.gov/vuln/detail/CVE-2023-3651 https://nvd.nist.gov/vuln/detail/CVE-2023-3651 Tue, 08 Aug 2023 15:15:10 +0000 Critical CVE-2023-3651

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2023-37647 – SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id p... https://nvd.nist.gov/vuln/detail/CVE-2023-37647 https://nvd.nist.gov/vuln/detail/CVE-2023-37647 Mon, 31 Jul 2023 13:15:09 +0000 Critical CVE-2023-37647

SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2023-23306 – The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4... https://nvd.nist.gov/vuln/detail/CVE-2023-23306 https://nvd.nist.gov/vuln/detail/CVE-2023-23306 Tue, 23 May 2023 20:15:09 +0000 Critical CVE-2023-23306

The `Toybox.Ant.BurstPayload.add` API method in CIQ API version 2.2.0 through 4.1.7 suffers from a type confusion vulnreability, which can result in an out-of-bounds write operation. A malicious application could create a specially crafted `Toybox.Ant.BurstPayload` object, call its `add` method, override arbitrary memory and hijack the execution of the device's firmware.

CVSS: 9.8 · CWE: CWE-787

View on NVD

]]> [Critical] CVE-2023-23303 – The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3... https://nvd.nist.gov/vuln/detail/CVE-2023-23303 https://nvd.nist.gov/vuln/detail/CVE-2023-23303 Tue, 23 May 2023 20:15:09 +0000 Critical CVE-2023-23303

The `Toybox.Ant.GenericChannel.enableEncryption` API method in CIQ API version 3.2.0 through 4.1.7 does not validate its parameter, which can result in buffer overflows when copying various attributes. A malicious application could call the API method with specially crafted object and hijack the execution of the device's firmware.

CVSS: 9.8 · CWE: CWE-120

View on NVD

]]> [High] CVE-2023-31741 – There is a command injection vulnerability in the Linksys E2000 router with firm... https://nvd.nist.gov/vuln/detail/CVE-2023-31741 https://nvd.nist.gov/vuln/detail/CVE-2023-31741 Tue, 23 May 2023 01:15:10 +0000 High CVE-2023-31741

There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ssid, wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.

CVSS: 7.2 · CWE: CWE-77

View on NVD

]]> [High] CVE-2023-31742 – There is a command injection vulnerability in the Linksys WRT54GL router with fi... https://nvd.nist.gov/vuln/detail/CVE-2023-31742 https://nvd.nist.gov/vuln/detail/CVE-2023-31742 Mon, 22 May 2023 17:15:09 +0000 High CVE-2023-31742

There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.

CVSS: 7.2 · CWE: CWE-77

View on NVD

]]> [Critical] CVE-2023-31707 – SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php. https://nvd.nist.gov/vuln/detail/CVE-2023-31707 https://nvd.nist.gov/vuln/detail/CVE-2023-31707 Fri, 19 May 2023 14:15:09 +0000 Critical CVE-2023-31707

SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [High] CVE-2023-22602 – When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a speciall... https://nvd.nist.gov/vuln/detail/CVE-2023-22602 https://nvd.nist.gov/vuln/detail/CVE-2023-22602 Sat, 14 Jan 2023 10:15:09 +0000 High CVE-2023-22602

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot co…

CVSS: 7.5 · CWE: CWE-436

View on NVD

]]> [Critical] CVE-2021-38733 – SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38733 https://nvd.nist.gov/vuln/detail/CVE-2021-38733 Fri, 28 Oct 2022 16:15:15 +0000 Critical CVE-2021-38733

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2021-38732 – SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38732 https://nvd.nist.gov/vuln/detail/CVE-2021-38732 Fri, 28 Oct 2022 16:15:15 +0000 Critical CVE-2021-38732

SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2021-38731 – SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38731 https://nvd.nist.gov/vuln/detail/CVE-2021-38731 Fri, 28 Oct 2022 16:15:15 +0000 Critical CVE-2021-38731

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2021-38730 – SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38730 https://nvd.nist.gov/vuln/detail/CVE-2021-38730 Fri, 28 Oct 2022 16:15:15 +0000 Critical CVE-2021-38730

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2021-38729 – SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38729 https://nvd.nist.gov/vuln/detail/CVE-2021-38729 Fri, 28 Oct 2022 16:15:14 +0000 Critical CVE-2021-38729

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2021-38737 – SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38737 https://nvd.nist.gov/vuln/detail/CVE-2021-38737 Fri, 28 Oct 2022 15:15:14 +0000 Critical CVE-2021-38737

SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2021-38736 – SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38736 https://nvd.nist.gov/vuln/detail/CVE-2021-38736 Fri, 28 Oct 2022 15:15:14 +0000 Critical CVE-2021-38736

SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2021-38734 – SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php. https://nvd.nist.gov/vuln/detail/CVE-2021-38734 https://nvd.nist.gov/vuln/detail/CVE-2021-38734 Fri, 28 Oct 2022 15:15:14 +0000 Critical CVE-2021-38734

SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [High] CVE-2020-11979 – As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of tem... https://nvd.nist.gov/vuln/detail/CVE-2020-11979 https://nvd.nist.gov/vuln/detail/CVE-2020-11979 Thu, 01 Oct 2020 20:15:13 +0000 High CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.

CVSS: 7.5 · CWE: CWE-379

View on NVD

]]> [High] CVE-2017-9810 – There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Ant... https://nvd.nist.gov/vuln/detail/CVE-2017-9810 https://nvd.nist.gov/vuln/detail/CVE-2017-9810 Mon, 17 Jul 2017 21:29:00 +0000 High CVE-2017-9810

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2015-2849 – SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 31... https://nvd.nist.gov/vuln/detail/CVE-2015-2849 https://nvd.nist.gov/vuln/detail/CVE-2015-2849 Tue, 07 Jul 2015 14:59:00 +0000 High CVE-2015-2849

SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [Critical] CVE-2007-5483 – Unspecified vulnerability in the Administrative Scripting Tools (such as wsadmin... https://nvd.nist.gov/vuln/detail/CVE-2007-5483 https://nvd.nist.gov/vuln/detail/CVE-2007-5483 Tue, 16 Oct 2007 23:17:00 +0000 Critical CVE-2007-5483

Unspecified vulnerability in the Administrative Scripting Tools (such as wsadmin or ANT) in IBM WebSphere Application Server 5.x and 6.0.x has unknown impact and attack vectors.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [High] CVE-2006-3223 – Format string vulnerability in CA Integrated Threat Management (ITM), eTrust Ant... https://nvd.nist.gov/vuln/detail/CVE-2006-3223 https://nvd.nist.gov/vuln/detail/CVE-2006-3223 Tue, 27 Jun 2006 21:05:00 +0000 High CVE-2006-3223

Format string vulnerability in CA Integrated Threat Management (ITM), eTrust Antivirus (eAV), and eTrust PestPatrol (ePP) r8 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a scan job with format strings in the description field.

CVSS: 7.5 · CWE: N/A

View on NVD

]]>