Omer Kaspi

The issue allows for a Denial of Service (DoS) of the OkHttp client when using a BrotliInterceptor and accessing a malicious web server, or when an attacker can perform a Man-in-the-Middle (MitM) attack to inject a Brotli zip-bomb into an HTTP response.

The issue is related to the incorrect management of code generation in Apache Cassandra, which can allow an attacker to execute arbitrary code on the host. This can be achieved by exploiting a specific configuration scenario where user-defined functions (UDFs) are enabled, allowing the attacker to effectively utilize the Nashorn JavaScript engine to escape the sandbox and execute unreliable code. The configuration that makes Cassandra vulnerable includes the following parameters in cassandra.yaml: enable user defined functions: true, enable scripted user defined functions: true, and enable user defined functions threads: false. When the enable user defined functions threads parameter is set to false, all invoked UDF functions are executed in the Cassandra daemon, which has a security manager with some permissions, thus allowing the attacker to disable the security manager, escape the sandbox, and run arbitrary shell commands on the server.

TensorFlow's `saved model cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the platform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe.

The issue allows attackers to read the entire filesystem on the device. This is achieved by using a crafted `getpage` parameter, enabling local file disclosure (LFD).

The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the `user` parameter to "cgi-bin/webupg".