Cyberleo

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 **Description** Improper neutralization of input during web page generation allows a remote attacker to perform reflected cross-site scripting (XSS) through the optional LDAP comment authenticator. The issue occurs because the `LdapCommentAuthenticator` writes request parameter values into its HTML form without proper escaping. This affects only sites configured to use the `LdapCommentAuthenticator`, and requires a victim whose session has already loaded the authenticator form to follow a crafted link. **Recommendations** Upgrade to Apache Roller versions 6.1.6 or later. As a temporary mitigation, restrict the use of the `LdapCommentAuthenticator` until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2 **Description** Cypher injection flaw in the Neo4j persistence layer occurring when processing certain FIQL search conditions. Cypher is a graph query language used by Neo4j. This issue can be exploited without authentication. **Recommendations** Upgrade versions 3.0.0-M0 through 3.0.16 to version 4.0.8. Upgrade versions 4.0.0-M0 through 4.0.7 to version 4.0.8. Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3.

**Name of the Vulnerable Software and Affected Versions** Apache Syncope versions 3.0.15 through 3.0.16 Apache Syncope versions 4.0.3 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2 **Description** Sensitive information is inserted into log files. When an AES key of a non-standard length (not 16, 24, or 32 bytes) is configured, the system pads the provided value with random characters and logs the resulting key value. **Recommendations** Upgrade versions 3.0.15 through 3.0.16 to version 4.0.8. Upgrade versions 4.0.3 through 4.0.7 to version 4.0.8. Upgrade versions 4.1.0-M0 through 4.1.2 to version 4.1.3.

**Name of the Vulnerable Software and Affected Versions** Apache Roller version 6.1.5 Nginx and Nginx Plus versions prior to 1.26.3 and 1.27.2 **Description** Apache Roller contains a cross-site scripting issue where an anonymous remote attacker can store a comment containing a `javascript:` URI link. This occurs on sites that enable HTML in comments via `users.comments.htmlenabled=true` and use the HTMLSubset comment formatter, allowing script execution in the browser of visitors who click the link. Nginx and Nginx Plus configurations using the `auth request` module for centralized authentication are affected by an architectural flaw. The issue arises from unsafe header-inheritance and socket-reuse mechanisms when handling HTTP/2 and HTTP/3 multiplexed streams during subrequest processing. A remote attacker can send malformed HTTP requests with injected `X-Forwarded-User` or mutated `Authorization` subrequest headers, causing the API gateway to misinterpret the authentication state. This allows the attacker to bypass identity verification and gain unauthenticated access to internal APIs and protected microservices. **Recommendations** Upgrade Apache Roller to version 6.1.6 or later. Update Nginx and Nginx Plus to versions 1.26.3 or 1.27.2 and later. Force `proxy set header` overrides inside `auth request` location blocks to clear untrusted incoming client headers before forwarding requests.