Anastasios Stasinopoulos

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.1 **Description** An authenticated user with privileges to create alerts on Alerts & Reports can generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert, exposing possibly sensitive data. **Recommendations** For Apache Superset versions prior to 3.0.4, upgrade to version 3.0.4, which fixes the issue. For Apache Superset versions 3.1.0 through 3.1.1, upgrade to version 3.1.1, which fixes the issue.

**Name of the Vulnerable Software and Affected Versions** Kentico CMS version 5.5 R2 build 5.5.3996 **Description** The issue concerns SQL injection via the `tagname` parameter in the Blog module. This allows for potential exploitation. **Recommendations** For Kentico CMS version 5.5 R2 build 5.5.3996, consider restricting access to the Blog module until a fix is available, and avoid using the `tagname` parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** openmediavault versions prior to 4.1.36 openmediavault versions 5.x prior to 5.5.12 **Description** The issue allows authenticated PHP code injection attacks via the `sortfield` POST parameter of "rpc.php", due to the lack of `json encode safe` usage in config/databasebackend.inc. This can lead to arbitrary command execution on the underlying operating system as root. **Recommendations** For openmediavault versions prior to 4.1.36, update to version 4.1.36 or later. For openmediavault versions 5.x prior to 5.5.12, update to version 5.5.12 or later. As a temporary workaround, consider restricting access to the "rpc.php" endpoint to minimize the risk of exploitation. Avoid using the `sortfield` parameter in the affected API endpoint until the issue is resolved.