Kai Aizen

A Kafka broker using the bundled JWKS-backed validator for SASL/OAUTHBEARER authentication verifies JWT signatures but does not enforce issuer and audience checks by default. Specifically, the issuer (`iss`) claim is only verified if `sasl.oauthbearer.expected.issuer` is configured, and the audience (`aud`) claim is only required if `sasl.oauthbearer.expected.audience` is configured. In multi-tenant environments or deployments with shared JWKS endpoints, this may allow a token from a different issuer or one lacking an audience to be accepted, potentially granting access as a higher-privileged principal.

An issue exists where the AI Assistant's `execute sql query` tool fails to properly validate queries supplied by a Large Language Model (LLM). The tool uses `sqlparse` to ensure only one non-transaction-control statement is executed within a read-only transaction. However, a discrepancy between how `sqlparse` and PostgreSQL handle string-literal lexing allows an attacker to smuggle multiple statements. By using a backslash before a quote, an attacker can bypass the validator and execute unauthorized commands, such as `COMMIT` or `CREATE TABLE`, leading to security restriction bypass, data manipulation, or remote code execution. This is achievable via indirect prompt injection, where a malicious payload is placed in an object that the AI Assistant reads.

The XML parser is not configured to prevent XML external entity (XXE) attacks. This allows attackers who can control the responses from the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location.

Missing permission checks allow users with Overall/Read permission to enumerate the names of configured Contrast metadata.

A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL using a specified username and password.

LWP::UserAgent leaks Authorization and Proxy-Authorization headers during cross-origin redirects. When a 3xx response is received, the redirect handler only removes the Host and Cookie headers before the subsequent request. Consequently, caller-supplied Authorization and Proxy-Authorization headers are transmitted unchanged to the redirect target, even if the scheme, host, or port changes. This allows a redirect to an attacker-controlled host to disclose the caller's credentials.

Insufficient sanitization of custom header name and value fields before they are written to the Apache .htaccess file via the `insert with markers()` function allows authenticated attackers with Administrator-level access or higher to perform CRLF Injection. This involves injecting arbitrary newline characters and additional Apache directives into the .htaccess configuration file through the 'Custom Headers' settings, which can result in Apache configuration parse errors and a potential site-wide denial of service.

An issue exists in the Riaxe Product Customizer plugin for WordPress where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query. The flaw is located in the 'options' parameter keys within `product data` of the '/wp-json/InkXEProductDesignerLite/add-item-to-cart' REST API endpoint.

The plugin contains a privilege escalation flaw due to an unauthenticated AJAX action ''wp ajax nopriv install-imprint'' that maps to the `ink pd add option()` function. This function processes the `option` and `opt value` variables from $ POST and executes `delete option()` and `add option()` using these values without nonce verification, capability checks, or an option name allowlist. Unauthenticated attackers can update arbitrary WordPress options, which may be used to enable user registration and set the default user role to administrator, leading to full site takeover.

An authorization bypass exists due to the registration of a REST API route ''/wp-json/InkXEProductDesignerLite/customer/delete customer'' without a permission callback. This configuration allows unauthenticated access to the `inkxe delete customer()` function, which processes an array of user IDs from the request body and passes them to `wp delete user()` without performing authentication or authorization checks. Consequently, unauthenticated attackers can delete arbitrary WordPress user accounts, including administrator accounts, resulting in complete site lockout and data loss.

This plugin for WordPress allows unauthenticated attackers to retrieve flipbook page metadata for draft, private, and password-protected flipbooks. This occurs due to a missing capability check in the `send post pages json()` function.

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB plugin for WordPress versions up to and including 2.0.9 Description The Advanced Contact form 7 DB plugin for WordPress has a flaw that allows unauthorized data access. This is due to a missing capability check on the `vsz cf7 export to excel` function. Attackers with Subscriber-level access or higher can export form submissions to an excel file. Recommendations Update to a version later than 2.0.9.

Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `vsz cf7 save setting callback()` function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to delete form entries by tricking a site administrator into clicking a malicious link.

Name of the Vulnerable Software and Affected Versions Riaxe Product Customizer plugin for WordPress versions up to and including 2.4 Description The Riaxe Product Customizer plugin for WordPress is susceptible to exposure of sensitive information. The '/wp-json/InkXEProductDesignerLite/orders' API endpoint lacks authentication or authorization checks due to its 'permission callback' being set to ' return true'. This allows unauthenticated attackers to retrieve customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses directly from the database. Recommendations Update the Riaxe Product Customizer plugin to a version later than 2.4.

The software does not properly validate certificates when connecting to Databricks, potentially allowing a man-in-the-middle attack where traffic is intercepted, manipulated, or credentials are stolen without the user being notified.

The MimeTypes Link Icons plugin for WordPress is susceptible to Server-Side Request Forgery. This occurs because the plugin makes outbound HTTP requests to user-controlled URLs without sufficient validation when the "Show file size" option is enabled. Authenticated attackers with Contributor-level access or higher can leverage this to make web requests to arbitrary locations from the web application. This could allow querying and modification of information from internal services through crafted links within post content.

Apache Airflow versions 3.1.0 through 3.1.7 contain a missing authorization issue within the Human-in-the-Loop (HITL) endpoints of the Execution API. This allows any authenticated task instance to perform actions—reading, approving, or rejecting—on HITL workflows belonging to other task instances. The HITL endpoints are part of the Execution API, which manages the execution of tasks within Airflow workflows. The issue stems from a lack of proper access controls, enabling unauthorized access and manipulation of HITL workflows.

A security issue exists due to insufficient input validation when processing Ingress resource annotations. An attacker can use the `nginx.ingress.kubernetes.io/rewrite-target` annotation to inject arbitrary configuration directives into the nginx.conf file. This configuration injection can lead to arbitrary code execution within the context of the ingress-nginx controller and the disclosure of Secrets accessible to the controller, which, in default installations, may include all Secrets cluster-wide.

Insufficient input sanitization when processing Telegram API responses allows unauthenticated attackers to perform DOM-Based Cross-Site Scripting (XSS). This occurs when the plugin handles attacker-controlled chat titles, enabling the injection of malicious scripts. The scripts execute when an administrator accesses the TelSender settings page and interacts with the "Tested" button.

The Friendly Functions for Welcart plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of, or incorrect, nonce validation on the settings page. An unauthenticated attacker could potentially update plugin settings by forging a request, provided they can trick a site administrator into performing an action, such as clicking a malicious link.