N0Mi1K

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization bypass allows authenticated users to modify task definitions in projects they are not authorized to access. The issue occurs at the '/dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream' endpoint, which fails to verify if the task definition identified by `code` belongs to the project specified by `projectCode`. An attacker can provide a `projectCode` they are authorized to access alongside a `code` from a different project to bypass restrictions and modify the target task definition and its upstream dependencies. Approximately 152,700 instances are identified globally. This flaw can compromise workflow integrity and disrupt task execution. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions 3.2.0 through 3.4.2 **Description** An authorization flaw allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may enable users to authenticate directly to the Kubernetes API outside the application. Depending on the permissions of the disclosed credentials, such as cluster-admin or privileged service-account access, an attacker could read Kubernetes Secrets, create pods, and establish persistent access to the cluster. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization flaw allows authenticated users to retrieve account information of other users. The issue occurs because the '/dolphinscheduler/users/list-all' endpoint does not enforce necessary authorization checks before returning data. This can lead to the exposure of sensitive user information and facilitate account enumeration. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 **Description** A race condition occurs when a localized message formats a date or time argument. The application-wide text provider retains a formatter that is shared across concurrent requests without proper isolation. This can lead to a scenario where data belonging to one user is displayed in another user's response or causes a server error during rendering. Applications that do not use date or time arguments in localized messages are not affected. **Recommendations** Upgrade versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.11.0 to version 6.12.0. Upgrade versions 7.0.0 through 7.3.0 to version 7.4.0.

**Name of the Vulnerable Software and Affected Versions** Apache Struts versions 2.1.8 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 **Description** The REST plugin allows request bodies to be read into memory without limits or throttling. This can lead to the exhaustion of the Java heap if a single request is large enough, resulting in a denial of service for other users. This issue occurs without requiring any additional settings to be enabled, though it only affects applications utilizing the REST plugin. **Recommendations** Upgrade versions 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.11.0 to version 6.12.0. Upgrade versions 7.0.0 through 7.3.0 to version 7.4.0.

**Name of the Vulnerable Software and Affected Versions** Apache Thrift versions prior to 0.25.0 **Description** An allocation of resources without limits or throttling issue exists in the Java `TSaslNonblockingServer`. This occurs when the server fails to properly restrict the consumption of system resources, potentially leading to resource exhaustion. **Recommendations** Update to version 0.25.0.

**Name of the Vulnerable Software and Affected Versions** Apache Thrift versions prior to 0.25.0 **Description** Apache Thrift Java bindings contain an issue where resources are allocated without limits or throttling, which can lead to resource exhaustion. **Recommendations** Upgrade to version 0.25.0.

**Name of the Vulnerable Software and Affected Versions** WSS4J versions prior to 4.0.2 WSS4J versions prior to 3.0.6 WSS4J versions prior to 2.4.4 **Description** In the streaming (StAX) code, a signature reference using the WS-Security STR-Transform causes an internal flag indicating content is signed to remain permanently set. The WS-SecurityPolicy enforcer relies on this flag to determine if an element requires checking; consequently, it ceases evaluating SignedParts and SignedElements for the remainder of the message. This allows a policy requiring the SOAP Body to be signed to be satisfied even if the Body lacks a signature, which eliminates protection against XML Signature Wrapping (a technique where an attacker modifies the XML structure to bypass security checks). Signature verification and DOM code remain unaffected. **Recommendations** Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.

**Name of the Vulnerable Software and Affected Versions** WSS4J versions prior to 4.0.2 WSS4J versions prior to 3.0.6 WSS4J versions prior to 2.4.4 **Description** An issue in the EncryptedHeader component allows child confusion, which could enable an attacker to promote a plaintext element as the decrypted header. This leads to incorrect confidentiality coverage and a potential policy bypass. **Recommendations** Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.

**Name of the Vulnerable Software and Affected Versions** Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 **Description** An authentication bypass exists in the DOM security processor. This allows unauthenticated remote attackers to forge authenticated SOAP messages by using a crafted unsigned SAML sender-vouches assertion that contains an attacker-controlled key. **Recommendations** Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.

**Name of the Vulnerable Software and Affected Versions** Apache CXF versions prior to 4.0.2 Apache CXF versions prior to 3.0.6 Apache CXF versions prior to 2.4.4 **Description** In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions (a language used to navigate through elements and attributes in an XML document) can be converted into paths that never match the actual XML element path. This allows a remote SOAP peer to send a required element without the expected signature or encryption. **Recommendations** Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.

**Name of the Vulnerable Software and Affected Versions** Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 **Description** An issue exists in the handling of the Nonce within the UsernameToken. The software stores the Nonce as raw base64 text, while the authentication process decodes this text to use the underlying bytes. Because the same bytes can be represented as base64 in multiple ways, an attacker can capture an authenticated request and resend it with a space added to the Nonce. This bypasses the replay cache because the modified token does not match the stored raw text, even though the password digest remains valid. Since the UsernameToken does not cover the message body, the captured token can be reused for arbitrary requests until it expires. This affects deployments using a password digest and a configured nonce replay cache, which is the default configuration for Apache CXF. **Recommendations** Upgrade to version 4.0.2. Upgrade to version 3.0.6. Upgrade to version 2.4.4.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An improper authorization check allows an authenticated user to operate on workflows in projects for which they lack the required permissions. This occurs when using the 'batch-copy' and 'batch-move' endpoints, potentially enabling the unauthorized copying or moving of workflows. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache Karaf (affected versions not specified) **Description** An issue exists in the `org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties)` function, which supports the config MBean and config shell commands. The software derives the configuration file path from user-supplied input without verifying that the resulting path remains within the `${karaf.etc}` directory. This occurs in two ways: if the property map includes a `felix.fileinstall.filename` entry, the value is converted directly into a File object, allowing it to point to any absolute path the process can write to; otherwise, the configuration PID is concatenated into the filename, allowing PIDs containing `..` segments to resolve outside the intended directory. The `createFactoryConfiguration()` function is similarly affected via the factory PID or alias. Users with the manager role can exploit this to write controlled content to sensitive files, such as `etc/users.properties` or `etc/org.apache.karaf.management.cfg`, potentially granting themselves admin privileges or taking over the container. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** The '/datasources/unauth-datasource' endpoint fails to properly enforce authorization for data sources. An authenticated user can call this endpoint to retrieve information about data sources they are not permitted to access, potentially exposing sensitive metadata and data source configurations. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An issue allows a weblog administrator to read files on the application classpath, including configuration files containing secrets. This occurs when a Velocity template is authored using an include directive to load a classpath resource outside the theme namespace. Although a Velocity sandbox is enabled to treat weblog administrators as untrusted, the include and parse directives are not confined by this sandbox. This affects any weblog where the administrator has permissions to author templates, regardless of the configuration. **Recommendations** Upgrade to Apache Roller version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authorization bypass exists that allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog. This occurs through unscoped identifier-based lookups in multi-user installations where users should be isolated. Additionally, a user with administrator rights on their own weblog can overwrite the Velocity template of another weblog, which is then evaluated when the victim weblog renders. Velocity is a Java-based template engine used to generate dynamic content. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authenticated user can read, modify, or delete weblog content belonging to other weblogs. This occurs because the handlers for the legacy XML-RPC Blogger and MetaWeblog APIs authenticate the caller but fail to verify if the caller has the necessary permissions for the specific weblog or entry being accessed. This issue only affects installations where the non-default global XML-RPC setting is enabled. **Recommendations** Upgrade to Apache Roller version 6.1.6 or later. Disable the XML-RPC feature.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Improper restriction of XML External Entity (XXE) references allows a weblog administrator to read files accessible by the Roller process and access internal network addresses. This occurs when importing a crafted OPML document because the bookmark import parser fails to disable external entity resolution. The issue is accessible via the administrator bookmark-import action and requires no non-default configuration. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** An authenticated user with entry-editing rights can trigger outbound HTTP requests to arbitrary destinations via legacy outbound Trackback and entry enclosure handling. Although the Trackback control is hidden in the standard UI, the action remains accessible. The issue occurs when an author provides an enclosure URL. Because the default Trackback allow-list is empty, it permits all destinations, including loopback and private-network addresses. Additionally, enclosure handling reveals the response status, content type, and length of the requested destination. **Recommendations** Upgrade to Apache Roller versions 6.1.6 or later.