Lza

**Name of the Vulnerable Software and Affected Versions** Datavane TIS version 5.0.0 **Description** An XML external entity (XXE) injection exists when the software processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Authenticated attackers can exploit this by supplying a crafted `taskScript` payload to the 'doEditWorkflow' endpoint. This allows for server-side request forgery (SSRF), where the server is forced to make outbound HTTP requests to attacker-controlled infrastructure, and out-of-band file exfiltration of local files readable by the TIS process user, such as configuration files and Derby database credentials. **Recommendations** Update Datavane TIS version 5.0.0 to a version where the DocumentBuilderFactory is hardened to disable external entities and DTD loading.

**Name of the Vulnerable Software and Affected Versions** MaxKey (affected versions not specified) **Description** An unauthorized access issue exists due to a hard-coded JWT signing secret within the `application-maxkey.properties` file. This allows unauthenticated attackers to forge valid JSON Web Tokens (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—and authenticate as any user. By utilizing the password-skipped login mechanism, attackers can sign a token with the default secret and submit it to the `/sign/login/jwt/trust` endpoint to obtain an authenticated administrator session, granting access to SSO application configurations and downstream application secrets. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LAMP Rapid Development Platform versions prior to 5.6.2 commit 84b0c27 **Description** An issue exists in GlueFactory that allows the execution of unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can manipulate the script field through message template endpoints to execute arbitrary Groovy code and operating system commands on the backend server. **Recommendations** Update LAMP Rapid Development Platform to the version containing commit 84b0c27.