Kwart

Name of the Vulnerable Software and Affected Versions: Hazelcast Platform versions prior to 5.3.5 Description: The issue is related to inadequate permission checking within the SQL mapping for the CSV File Source connector in Hazelcast Platform. This could enable unauthorized clients to access data from files stored on a member's filesystem. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. Recommendations: For versions prior to 5.3.5, update to version 5.3.5 or later to resolve the issue. As a temporary workaround, consider disabling the Hazelcast Jet processing engine in Hazelcast member configuration to minimize the risk of exploitation, noting that this will prevent SQL and Jet jobs from working.

**Name of the Vulnerable Software and Affected Versions** hazelcast/hazelcast versions 5.1-BETA-1 through 5.1 **Description** The issue is related to an improper restriction of XML external entity references, allowing for XXE attacks. The `AbstractXmlConfigRootTagRecognizer()` function uses a SAXParser generated from a SAXParserFactory with no `FEATURE SECURE PROCESSING` set. This enables potential exploitation. **Recommendations** For versions 5.1-BETA-1 through 5.1, update to version 5.1 or later to resolve the issue. As a temporary workaround, consider setting `FEATURE SECURE PROCESSING` in the SAXParserFactory to prevent XXE attacks.

**Name of the Vulnerable Software and Affected Versions** WildFly versions 8.1.0.Final through 8.2.0.Final WildFly versions 9.0.0.CR1 **Description** The issue allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL. **Recommendations** For WildFly version 8.1.0.Final, update to a version after 8.1.0.Final. For WildFly version 8.2.0.Final, update to a version after 8.2.0.Final. For WildFly version 9.0.0.CR1, update to a version after 9.0.0.CR1, such as 9.0.0.CR2.