Gal Goldshtein

**Name of the Vulnerable Software and Affected Versions** HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 **Description** The issue is related to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. Certain parameters are not sanitized when passed to the user-provided MSSQL database, allowing an attacker to modify these parameters and execute a malicious SQL command. This can occur when configuring the MSSQL plugin through the local configuration. **Recommendations** For versions 0.8.0 through 1.13.0, update to version 1.13.1, 1.12.5, or 1.11.9 to resolve the issue. As a temporary workaround, consider restricting access to the MSSQL Database Storage Backend configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zalando Skipper versions prior to 0.13.218 **Description** A query predicate could be bypassed via a prepared request. **Recommendations** For versions prior to 0.13.218, update to version 0.13.218 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** nginx versions 1.14.0 through 1.14.1 nginx versions 1.15.0 through 1.15.6 **Description** The issue is related to the implementation of HTTP/2 in nginx, which can lead to excessive CPU usage. This problem affects nginx compiled with the ngx http v2 module, but only if the 'http2' option of the 'listen' directive is used in a configuration file. The vulnerability can be exploited by a remote attacker to cause a denial of service. **Recommendations** For versions 1.14.0 through 1.14.1, update to version 1.14.1 or later. For versions 1.15.0 through 1.15.6, update to version 1.15.6 or later. As a temporary workaround, consider disabling the `ngx http v2 module` module or removing the 'http2' option from the 'listen' directive in the configuration file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions 2.4.17 through 2.4.34 **Description** The issue is related to insufficient input validation in the Apache HTTP Server, which can be exploited by a remote attacker to cause a denial of service by exhausting the limit of simultaneously open connections through continuous sending of maximum-sized SETTINGS frames. This affects only HTTP/2 connections. **Recommendations** For Apache HTTP Server versions 2.4.17 through 2.4.34, a possible mitigation is to not enable the h2 protocol.

**Name of the Vulnerable Software and Affected Versions** Ktools.net Photostore versions prior to 4.7.5 **Description** The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `email` parameter in a "recover login" action within the mgr.login.php file. **Recommendations** For versions prior to 4.7.5, update to version 4.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the mgr.login.php file or the recover login action to minimize the risk of exploitation. Avoid using the `email` parameter in the affected action until the issue is resolved.