Meifukun

**اسم البرنامج المصاب والإصدارات المتأثرة** Frappe ERPNext الإصدارات السابقة لـ 15.120.0 Frappe ERPNext إصدارات 16.x السابقة لـ 16.33.0 **Description** تفشل بعض نقاط النهاية في فرض فحوصات الأذونات المناسبة. يتيح ذلك للمستخدمين المصرح لهم بصلاحيات منخفضة طلب نقاط النهاية هذه مباشرة لقراءة البيانات المالية التي تتجاوز ما يسمح به دورهم المعين. **Recommendations** التحديث إلى الإصدار 15.120.0 أو أحدث. التحديث إلى الإصدار 16.33.0 أو أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** Frappe ERPNext الإصدارات السابقة لـ 15.121.3 Frappe ERPNext الإصدارات السابقة لـ 16.35.0 **الوصف** تفشل بعض نقاط النهاية (endpoints) في فرض ضوابط تفويض مناسبة. يتيح ذلك للمستخدمين المصرح لهم إرسال طلبات إلى نقاط النهاية هذه لتعديل بيانات تتجاوز الصلاحيات المسموح بها لدورهم الوظيفي المحدد. **التوصيات** التحديث إلى الإصدار 15.121.3 أو أحدث. التحديث إلى الإصدار 16.35.0 أو أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** Frappe ERPNext الإصدارات السابقة لـ 15.121.3 Frappe ERPNext إصدارات 16.x السابقة لـ 16.35.0 **Description** تفشل بعض نقاط النهاية في فرض ضوابط التفويض القائمة على الأدوار. يتيح ذلك للمستخدمين المصرح لهم طلب هذه النقاط لقراءة بيانات مالية تتجاوز الأذونات الممنوحة لأدوارهم المحددة. **Recommendations** التحديث إلى الإصدار 15.121.3 أو أحدث. التحديث إلى الإصدار 16.35.0 أو أحدث.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization bypass allows authenticated users to operate task instances in projects they are not authorized to access. This occurs through the following API endpoints: - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop' - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint' **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions 3.2.0 through 3.4.2 **Description** An authorization flaw allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may enable users to authenticate directly to the Kubernetes API outside the application. Depending on the permissions of the disclosed credentials, such as cluster-admin or privileged service-account access, an attacker could read Kubernetes Secrets, create pods, and establish persistent access to the cluster. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization bypass allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances across different projects. The system verifies permissions against the provided `projectCode` but does not confirm if the target resource actually belongs to that project. Consequently, a user with permissions in one project can use that project's code alongside a resource identifier from another project to bypass access restrictions. This allows attackers to alter workflow availability and interfere with task execution in unauthorized projects via the following endpoints: - 'POST /projects/{projectCode}/schedules/{id}/online' - 'POST /projects/{projectCode}/schedules/{id}/offline' - 'POST /projects/{projectCode}/workflow-definition/{code}/release' **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** The '/datasources/unauth-datasource' endpoint fails to properly enforce authorization for data sources. An authenticated user can call this endpoint to retrieve information about data sources they are not permitted to access, potentially exposing sensitive metadata and data source configurations. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Missing authentication for a critical function allows an unauthenticated remote attacker to persistently change a site-global configuration value regarding the frontpage weblog selection. This occurs because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. This issue can result in the redirection or disruption of the site's public frontpage. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authorization bypass exists that allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog. This occurs through unscoped identifier-based lookups in multi-user installations where users should be isolated. Additionally, a user with administrator rights on their own weblog can overwrite the Velocity template of another weblog, which is then evaluated when the victim weblog renders. Velocity is a Java-based template engine used to generate dynamic content. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Improper restriction of XML External Entity (XXE) references allows a user with entry-editing rights on a weblog to force the server to parse a trackback response using an XML parser that does not disable external entity resolution. This can lead to the disclosure of files readable by the Roller process. Although the Trackback control is hidden in the standard UI, the action remains directly reachable without requiring any non-default server configuration. **Recommendations** Upgrade to Apache Roller version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller but fail to verify if the caller has the necessary permissions for the specific weblog or entry being accessed. This issue only affects installations where the non-default global XML-RPC setting is enabled. **Recommendations** Upgrade to Apache Roller version 6.1.6 or later. Disable the XML-RPC feature.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Incorrect authorization in the OAuth 1.0a authorization endpoint allows an unauthenticated remote attacker to bind an outstanding request token for a configured site-wide consumer to an arbitrary user account, such as an administrator. This occurs because the endpoint derives the authorizing identity from a request-supplied value instead of the authenticated session. This issue only affects installations that configure an OAuth 1.0a site-wide consumer and requires the attacker to know an outstanding request token. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authenticated user with entry-editing rights can trigger outbound HTTP requests to arbitrary destinations via legacy outbound Trackback and entry enclosure handling. Although the Trackback control is hidden in the standard UI, the action remains accessible. The issue occurs when an author provides an enclosure URL. Because the default Trackback allow-list is empty, it permits all destinations, including loopback and private-network addresses. Additionally, enclosure handling reveals the response status, content type, and length of the requested destination. **Recommendations** Upgrade to Apache Roller versions 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authentication bypass exists due to a capture-replay flaw in the AtomPub API. An attacker can capture a valid WSSE digest authentication header and replay it to gain the authority of the victim. This occurs because the authentication process fails to enforce timestamp freshness or the uniqueness of the nonce (a random number used once to prevent replay attacks). This issue only affects installations where the non-default AtomPub API is enabled with WSSE authentication and plaintext-compatible password storage. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Cross-Site Request Forgery (CSRF) occurs when the CSRF validation filters accept requests that omit the required salt token, instead validating against a value generated by the server for that request. This allows a remote attacker to induce a logged-in author or administrator to visit a crafted page and perform state-changing actions under their authority. This issue does not require any optional features or non-default configurations. **Recommendations** Upgrade to Apache Roller versions 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Improper neutralization of input during web page generation leads to stored cross-site scripting (XSS) in the authoring UI. A user with authoring rights can store crafted content that is subsequently written into JavaScript string literals and markup sinks without proper encoding. This allows the stored script to execute in the browser of another author or administrator. This issue affects weblogs with multiple authors or administrators who are not mutually trusted and requires no optional features or non-default configurations. **Recommendations** Upgrade to Apache Roller versions 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Improper neutralization of input during web page generation allows a remote attacker to perform reflected cross-site scripting (XSS) against visitors of a weblog. This occurs when the bundled frontpage theme reflects the `blog-directory` parameter without proper escaping. For the attack to succeed, the weblog must be using the bundled frontpage theme and the victim must follow a crafted link. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2 **Description** Improper encoding or escaping of output allows authenticated users to store a spreadsheet formula payload within their own plain attributes. If these users are included in a CSV export, the formula may be executed when the resulting CSV file is opened by a spreadsheet application. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.8 Upgrade versions 4.0.0-M0 through 4.0.7 to version 4.0.8 Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2 **Description** An Open Redirect issue exists when the Syncope SRA is configured for CAS authentication. The target Apereo CAS instance URL is determined by unconditionally trusting client-supplied forwarded HTTP headers, allowing redirection to untrusted sites. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.8 Upgrade versions 4.0.0-M0 through 4.0.7 to version 4.0.8 Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** Joomla! Core (لم يتم تحديد الإصدارات المتأثرة) **الوصف** يؤدي عدم وجود إجراءات حماية في عرض قائمة التحديثات بمكون `com installer` إلى حدوث ثغرة من نوع «التنفيذ البرمجي عبر المواقع» (XSS). وتُعد ثغرة XSS عيبًا يتيح للمهاجم إدخال نصوص برمجية ضارة في صفحات الويب التي يشاهدها مستخدمون آخرون. **التوصيات** في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.