Ho1Aas

An authenticated user with low privileges can perform forced browsing to access financial account services. This allows the unauthorized creation, modification, and cancellation of financial account transactions and balances through direct requests to the following services: `createFinAccount()`, `updateFinAccount()`, `deleteFinAccount()`, `createFinAccountTrans()`, `createFinAccountRole()`, `createFinAccountAuth()`, `setFinAccountTransStatus()`, and `depositWithdrawPayments()`.

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS from version 1.0 through 1.6 inclusive. Other modules such as sis-referencing are not impacted. Users are recommended to upgrade to version 1.7, which fixes the issue.

This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected to be in some specific formats and the reading stops at the first parsing error, which makes this vulnerability unlikely to leak sensitive information. The impacted formats are: * Geographic Markup Language (GML) with `xlink:href` attributes for other files in GML format. * Well Known Text (WKT) with parameter elements for datum shift grids in NADCON, NTv2 or RGF93 formats. * Landsat scene with paths to files for each band in the GeoTIFF format. Users are recommended to upgrade to version 1.7, which fixes the issue by restricting the paths to the same directory as the file containing the references to other files, or to a predetermined directory for datum shift grids.

**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.

Uncontrolled Resource Consumption in the JDBC driver allows for large-scale memory exhaustion. This occurs during the execution of the `toPlainString()` function when processing `BigDecimal` objects.

Uncontrolled recursion occurs within the Dart and Java ME bindings. Uncontrolled recursion is a condition where a function calls itself without a proper termination condition, potentially leading to a stack overflow and application crash.

A loop with an unreachable exit condition, resulting in an infinite loop, exists within the c glib bindings.

Apache Thrift Dart bindings contain an issue involving improper handling of length parameter inconsistency, which can lead to memory allocation with an excessive size value.

Apache Thrift contains an issue involving the allocation of resources without limits or throttling, integer overflow or wraparound, and a heap-based buffer overflow. A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer than it can hold, potentially leading to crashes or arbitrary code execution.

Improper handling of length parameter inconsistency and allocation of resources without limits or throttling in Apache Thrift Lua bindings. Specifically, the `TBinaryProtocol:readMessageBegin()` function bypasses `checkStringSize()` on the pre-versioned name.

The Apache Thrift Python bindings contain an issue where resources are allocated without limits or throttling and a resource is initialized with an insecure default.

The c glib bindings in Apache Thrift contain an issue involving the use of an uninitialized resource and the return of an incorrect status code.

Improper input validation in the `sshd-git` component allows authenticated SSH clients to potentially execute unauthorized git commands. The `GitPgmCommandFactory` class enables the remote execution of git commands via the JGit library on server-stored repositories. A previous attempt to restrict the `archive` command failed to remove the single-argument `-o=file.zip` version of the command parameter, allowing files to be written to the server.

Uncontrolled resource consumption exists in the `sshd-scp` component, which provides a Java implementation of the Secure Copy Protocol (SCP). The SCP command protocol is line-oriented and relies on Line Feed (LF) characters to terminate lines. Because the protocol handler does not impose a limit on the length of these lines, a malicious peer can send a continuous sequence of characters without an LF terminator. This forces the receiver to allocate excessive memory to store the command, leading to memory exhaustion and an `OutOfMemoryError` that crashes the application.

The `sshd-sftp` component of the Apache MINA SSHD Java library contains a flaw in the `DefaultSftpClient` implementation. When receiving a reply, the client fails to verify if the response corresponds to a previously sent request. Consequently, unsolicited replies are stored without being consumed, allowing a malicious server to send continuous unsolicited responses until the client's available memory is exhausted, leading to memory exhaustion.

Server-side memory exhaustion occurs in the `sshd-sftp` component within the SFTP v6 `check-file-name`/`check-file-handle` extension. When a very small `block size` is used on a large file, the system generates an excessive number of hashes. Because the resulting SFTP reply message is accumulated entirely in the server memory, a sufficiently large or sparse file can exhaust available memory and cause the server to crash.

A missing check in the `LdapPasswordAuthenticator` function within the `sshd-ldap` component allows attackers to bypass password authentication. This issue specifically affects SSH servers that use the optional `sshd-ldap` component and have configured `LdapPasswordAuthenticator` for password authentication. Standard password authentication provided by the `sshd-core` mechanisms is not affected.

An authentication bypass exists in the optional `sshd-ldap` component, which integrates password and public key authentication with an LDAP server. The issue stems from a lack of escaping for LDAP filter metacharacters, allowing successful authentication by using `*` for both the `username` and `password` variables.

Apache WSS4J fails to properly validate bounds for derived-key lengths and offsets provided by a user. This flaw allows the processing of crafted WS-Security messages to result in the use of cryptographically weak keys or cause excessive CPU and memory consumption.

Cypher injection flaw in the Neo4j persistence layer occurring when processing certain FIQL search conditions. Cypher is a graph query language used by Neo4j. This issue can be exploited without authentication.