Abhishek Raj

**Name of the Vulnerable Software and Affected Versions** Quarkus (affected versions not specified) **Description** A flaw in the Qute template engine, used for generating dynamic content such as HTML pages or emails, allows for a security bypass. The issue resides in the `ReflectionValueResolver` component, which does not properly restrict access to sensitive Java internal functions when processing specific data types, such as Enums. An attacker capable of influencing the template text can exploit this to execute unauthorized commands and gain control of the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** vscode-java (affected versions not specified) **Description** The vscode-java extension, which provides Java language support for Visual Studio Code, incorrectly trusts all Markdown content in JavaDoc hovers. This allows a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, potentially leading to full system compromise in trusted workspaces. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Preferred Providers app version 1.6.0 **Description** The issue is related to an improper check of inputs in the Nextcloud Preferred Providers app, which allows a denial of service attack to be performed when a very long password is used. **Recommendations** For Nextcloud Preferred Providers app version 1.6.0, update to a newer version that contains a fix for this issue, as using a very long password can cause a denial of service attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.