姬珏

Improper neutralization of input during web page generation allows a remote attacker to perform reflected cross-site scripting (XSS) through the optional LDAP comment authenticator. The issue occurs because the `LdapCommentAuthenticator` writes request parameter values into its HTML form without proper escaping. This affects only sites configured to use the `LdapCommentAuthenticator`, and requires a victim whose session has already loaded the authenticator form to follow a crafted link.

Apache Roller contains a cross-site scripting issue where an anonymous remote attacker can store a comment containing a `javascript:` URI link. This occurs on sites that enable HTML in comments via `users.comments.htmlenabled=true` and use the HTMLSubset comment formatter, allowing script execution in the browser of visitors who click the link. Nginx and Nginx Plus configurations using the `auth request` module for centralized authentication are affected by an architectural flaw. The issue arises from unsafe header-inheritance and socket-reuse mechanisms when handling HTTP/2 and HTTP/3 multiplexed streams during subrequest processing. A remote attacker can send malformed HTTP requests with injected `X-Forwarded-User` or mutated `Authorization` subrequest headers, causing the API gateway to misinterpret the authentication state. This allows the attacker to bypass identity verification and gain unauthenticated access to internal APIs and protected microservices.