M1Sn0W

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions through 18.12.14 **Description** This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue. **Recommendations** Apache OFBiz versions through 18.12.14: Upgrade to version 18.12.15 to resolve the issue. As a temporary workaround, consider restricting access to unauthenticated endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Confluence Data Center and Server versions 7.19.0 through 7.19.16 Confluence Data Center and Server versions 8.5.0 through 8.5.4 Confluence Data Center versions 8.7.0 through 8.7.1 **Description** The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary code. This has a high impact on confidentiality, integrity, and availability, and requires no user interaction. The vulnerability was discovered by m1sn0w and reported via the Bug Bounty program. **Recommendations** For Confluence Data Center and Server version 7.19: Upgrade to a release 7.19.17, or any higher 7.19.x release For Confluence Data Center and Server version 8.5: Upgrade to a release 8.5.5 or any higher 8.5.x release For Confluence Data Center version 8.7: Upgrade to a release 8.7.2 or any higher release

**Name of the Vulnerable Software and Affected Versions** Crowd Data Center and Server version 3.4.6 Crowd Data Center and Server versions prior to 5.1.6 Crowd Data Center and Server versions prior to 5.2.1 **Description** This issue allows an authenticated attacker to execute arbitrary code, which has a high impact on confidentiality, integrity, and availability, and requires no user interaction. The vulnerability was discovered by m1sn0w and reported via the Bug Bounty program. **Recommendations** For Crowd Data Center and Server 3.4, upgrade to a release greater than or equal to 5.1.6. For Crowd Data Center and Server 5.2, upgrade to a release greater than or equal to 5.2.1. If you are unable to upgrade to the latest version, consider upgrading your instance to one of the specified supported fixed versions.