Erik Villegas

**Name of the Vulnerable Software and Affected Versions** Apache Airflow version 3.3.0 **Description** In the `awaiting input` task state, the scheduler deserializes the `next kwargs` variable of a task instance without using an allow-list. A DAG author can manipulate this value via the task execution API to trigger arbitrary module imports and object instantiation within the scheduler process, or cause the scheduler job to terminate. This process occurs automatically every 15 seconds and is not mitigated by the default `allowed deserialization classes` setting. **Recommendations** Upgrade to apache-airflow version 3.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Intermark IT WebControl CMS version 3.5 **Description** An HTML injection issue exists in the contact form, allowing an attacker to send emails containing malicious HTML code to a victim. This is achieved by sending a request to the '/processContact.do' endpoint using the `nombreApellidos`, `dirección`, and `comentarios` parameters. **Recommendations** As a temporary workaround, restrict access to the '/processContact.do' endpoint or avoid using the `nombreApellidos`, `dirección`, and `comentarios` parameters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebControl CMS version 3.5 **Description** An issue exists that allows an attacker to execute JavaScript code or inject a dynamic iframe into a victim's browser. This is achieved by sending a malicious URL through the `urlDestino` parameter in the '/portal.do' endpoint. This flaw can be used to steal sensitive user data, such as session cookies, display phishing interfaces, or perform actions on behalf of the user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `urlDestino` parameter in the '/portal.do' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Youzify - Buddypress Moderation versions 1.2.5 and earlier **Description** The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This allows for a remote attack. **Recommendations** Update the plugin to a version later than 1.2.5. As a temporary workaround, consider restricting access to the plugin until a patch is available.