Jonathan Leitschuh

Servers fail to validate the "Origin" header on incoming connections, which may allow DNS rebinding attacks. DNS rebinding is a method of bypassing the Same-Origin Policy to interact with services on a private network from a remote browser.

Incoming connections are not validated for the `Origin` header. This flaw enables a DNS rebinding attack—a technique used to bypass the Same-Origin Policy—via a victim's web browser. An attacker can send unauthorized requests to a locally running MCP server, leading to the unintended invocation of MCP tool endpoints.

Anyscale Ray 2.52.0 has a default configuration where token-based authentication for Ray management interfaces, including the dashboard and Jobs API, is disabled unless explicitly enabled by setting the `RAY AUTH MODE` variable to 'token'. Without authentication enabled, a remote attacker with network access to these interfaces can submit jobs and execute arbitrary code on the Ray cluster. The API endpoint for job submission is vulnerable.

Instances of cors-anywhere configured as an open proxy permit unauthenticated external users to initiate HTTP requests to arbitrary targets, leading to Server-Side Request Forgery (SSRF). The proxy forwards requests and headers, potentially granting access to internal-only endpoints and link-local metadata services. This can result in the retrieval of instance role credentials or other sensitive metadata, and interaction with internal APIs and services. Exploitation involves sending crafted requests to the proxy with the target resource encoded in the URL. Deployments that forward arbitrary methods and headers, including PUT, may allow exploitation of IMDSv2 workflows and access to internal management APIs. Successful exploitation can lead to theft of cloud credentials, unauthorized access to internal services, remote code execution, privilege escalation, data exfiltration, and full compromise of cloud resources.

The issue allows an attacker to control file names or paths via the `include` tag, potentially accessing sensitive local files like `/etc/passwd` or `/proc/1/environ` by crafting malicious notification templates.

The issue allows users with the `SYSTEM CONFIGURATION` permission to abuse the `include` tag in notification templates, potentially leaking sensitive local files, such as `/etc/passwd` or `/proc/1/environ`, by including them in notification templates and sending notifications to a controlled destination.

The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects products that are no longer supported by the maintainer.

The issue is related to an Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.default.secret`, a default value will be used. This vulnerability only affects products that are no longer supported by the maintainer. As the project is retired, no fix will be released.

The issue is related to improper input validation in the Apache Hop Engine, specifically affecting the Hop Server component. When the Hop Server writes links to the PrepareExecutionPipelineServlet page, one of the parameters provided to the user, the `id`, is not properly escaped. This makes the risk of exploiting this issue low, as the `id` is not directly accessible by users creating pipelines. The issue does not directly affect the client.

The issue is related to insufficient protection of registration data in Apache Linkis, which may allow a remote attacker to gain unauthorized access to protected information. Specifically, when using the Oracle data source of the Linkis data source module, the password is printed to the log.

The issue is related to the exposure of sensitive information to an unauthorized actor. This vulnerability may allow an attacker to gain unauthorized access to protected information.

The issue is related to an Insecure Temporary File in the `StdTempFileProvider()` function, located in `StdTempFileProvider.java`. This function utilizes the permissive `File.createTempFile()` function, which exposes the contents of temporary files.

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users.

A problematic vulnerability was found in cloudsync, affecting the `getItem` function of the `LocalFilesystemConnector.java` file. This vulnerability leads to path traversal and can be exploited on the local host.

A critical vulnerability was found in Widoco, affecting the `unZipIt` function of the file `src/main/java/widoco/WidocoUtils.java`. This issue leads to path traversal and can be exploited on the local host.

A vulnerability was found in pig-vector, classified as problematic, affecting the `LogisticRegression` function of the file `src/main/java/org/apache/mahout/pig/LogisticRegression.java`. This issue leads to an insecure temporary file and requires a local attack approach.

A critical vulnerability was found in jLEMS, affecting the `unpackJar` function of the file `src/main/java/org/lemsml/jlems/io/util/JUtil.java`. This vulnerability leads to path traversal and can be exploited remotely.

A critical issue has been found in the `extractZip` function of the `RemoteZipHandler.java` file, part of the ZIP File Handler component. This issue leads to path traversal and can be exploited remotely.

A critical vulnerability was found in scifio, affecting the function `downloadAndUnpackResource` of the file `src/test/java/io/scif/util/DefaultSampleFilesService.java` of the component ZIP File Handler. The manipulation leads to path traversal. The attack can be launched remotely.

The issue arises from the `createTempDir()` function in `util/IOUtil.java` not checking for the existence of the temporary directory before attempting to create it, leading to the creation of temporary files in directories with insecure permissions. This is due to the `createTempDir()` function's behavior.