Himanshu Anand

**Name of the Vulnerable Software and Affected Versions** Apache Log4j API versions 2.13.1 through 2.25.4 Apache Log4j API version 2.26.0 **Description** Improper encoding of non-finite IEEE 754 floating-point values (NaN, Infinity, or -Infinity) during MapMessage JSON serialization produces output that is not valid JSON. This occurs when `MapMessage.asJson()` or `MapMessage.getFormattedMessage(new String[]{"JSON"})` is used, as they emit bare tokens not permitted by RFC 8259. The issue is reachable if an application uses the event template resolver of JsonTemplateLayout or any other layout relying on these methods and logs a `MapMessage` containing an attacker-controlled floating-point value. This can result in malformed JSON, potentially corrupting log records or disrupting downstream log ingestion and parsing. **Recommendations** For versions 2.13.1 through 2.25.4, upgrade to Apache Log4j API 2.25.5. For version 2.26.0, upgrade to Apache Log4j API 2.26.1.

**Name of the Vulnerable Software and Affected Versions** Joomla! Core (affected versions not specified) **Description** An improper access check allows unauthorized users to access datasets within the `com privacy` webservice endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nmap versions 7.0.0 through 7.99 **Description** An issue exists in the `ipv6 get data primitive` function (libnetutil/netutil.cc) where the IPv6 extension-header walk is not kept within the captured packet. This causes the pointer to advance past the buffer, leading the remaining-length computation to underflow to a large value. A scanned target or an on-path attacker can trigger out-of-bounds reads and a crash during raw IPv6 scans by returning a crafted IPv6 response with a truncated extension header. **Recommendations** Update Nmap to a version later than 7.99.

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** The Media module supports oEmbed, which utilizes two discovery mechanisms: `providers.json` and URL discovery. The URL discovery code can be exploited to trick the system into making unauthorized server-side requests to any arbitrary URL. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker can force a server to send requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.