Digest · Wednesday
Security digest: April 23, 2025
2 critical advisories.
All digests · RSS · Markdown
Take stock
- Maven: 1 critical advisory (
org.xwiki.platform:xwiki-platform-rest-server). Check withmvn dependency:tree -Dincludes=<groupId>:<artifactId>. - NuGet: 1 critical advisory (
YoutubeDLSharp). Check withdotnet list package --vulnerable --include-transitive. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Known exploited (CISA KEV) 0
Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.
None.
Critical advisories by ecosystem 2
GitHub-reviewed advisories rated critical, published this day (Pacific time).
Maven 1
Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>
- org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API CVE-2025-32969 CVSS 9.3 Critical
org.xwiki.platform:xwiki-platform-rest-server>= 1.8, < 15.10.16 → fixed in 15.10.16;org.xwiki.platform:xwiki-platform-rest-server>= 16.0.0-rc-1, < 16.4.6 → fixed in 16.4.6;org.xwiki.platform:xwiki-platform-rest-server>= 16.5.0-rc-1, < 16.10.1 → fixed in 16.10.1
NuGet 1
Check: dotnet list package --vulnerable --include-transitive
- YoutubeDLSharp allows command injection on windows system due to non sanitized arguments CVE-2025-43858 CVSS 9.2 Critical
YoutubeDLSharp>= 1.0.0-beta4, < 1.1.2 → fixed in 1.1.2