Nbxiglk

A malicious script injection issue exists in the Apache Geode web-api (REST). An attacker can trick a logged-in user into clicking a specially-crafted link, leading to code execution on the returned page. This could result in the theft of the user's session information and potential account takeover. The vulnerability impacts the REST API.

Name of the Vulnerable Software and Affected Versions: Apache IoTDB versions 1.0.0 through 1.3.3 Description: The issue is related to a Remote Code Execution vulnerability with untrusted URI of UDF in Apache IoTDB. An attacker with privilege to create UDF can register a malicious function from an untrusted URI. Recommendations: For Apache IoTDB versions 1.0.0 through 1.3.3, upgrade to version 1.3.4, which fixes the issue. As a temporary workaround, consider restricting the creation of UDFs to trusted sources until the upgrade is applied.

The issue is related to improper control of code generation, allowing an attacker to inject sensitive configuration or malicious code when connecting to a MySQL database via a JDBC driver.

The issue concerns an Improper Input Validation vulnerability, allowing an authenticated user to execute arbitrary, unsandboxed javascript on the server. This can lead to arbitrary js execution as root for authenticated users.

The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows some sensitive parameter checks to be bypassed, including `autoDeserizalize` and `allowLoadLocalInfile`.

The issue is related to a Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. This vulnerability can be exploited by a malicious SVG, which could trigger the loading of external resources by default, causing resource consumption or, in some cases, information disclosure.

The issue is related to the Remote Resource Handler component of Apache NiFi, which is associated with incorrect code generation management. This can allow a remote attacker to execute arbitrary code. The vulnerability is exploited when an authenticated and authorized user configures a location that enables custom code execution, using HTTP URL references for retrieving drivers in Processors and Controller Services.

The issue allows for a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This is due to the JMSSource class being configured with a `providerUrl` parameter, which performs a JNDI lookup without validation, potentially leading to the deserialization of untrusted data.