Kuiplatain

This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.

The issue is related to improper input validation, which can be exploited by a remote attacker to disclose protected information or cause a denial of service using a specially crafted XML request. This vulnerability affects products that are no longer supported by the maintainer.

The issue allows segment directories to be imported into Pinot tables through the segment upload path in Apache Pinot. In installations with open access to the controller, a specially crafted request can potentially disrupt the Pinot service.