D0Hy30N

**Name of the Vulnerable Software and Affected Versions** Apache CloudStack versions 4.21.0.0 through 4.22.1.0 **Description** Improper Access Control in the Kubernetes Service (CKS) plugin allows cross-tenant manipulation of the Kubernetes cluster during the process of adding and removing nodes. **Recommendations** Upgrade to version 4.22.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 1.10.0 through 2.10.0 **Description** A Parameter Context update REST API method fails to enforce authorization checks on components that reference parameter values. While framework authorization was limited to read and write privileges on the Parameter Context itself, an authenticated user with permission to modify a Parameter Context could alter values affecting components they are not authorized to access. In environments where parameter values contain executable scripting content, this could lead to code execution during automatic component validation, even if the referencing component is not started. This issue specifically affects deployments using component-level authorization policies and is limited to stopped components. **Recommendations** Update to version 2.11.0.