Pyn3Rd

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109 **Description** An incorrect authorization issue exists in the FORM authentication process. This allows the bypassing of a security constraint that restricts a user to POST access while denying GET access to a resource. **Recommendations** Upgrade to version 11.0.25. Upgrade to version 10.1.58. Upgrade to version 9.0.121.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109 **Description** Improper access control and incorrect authorization allow an unauthenticated attacker to bypass security constraints. This occurs when a security constraint for a longer path is processed before a more restrictive constraint for a shorter sub-path, leading the system to evaluate constraints incorrectly and grant access to protected resources. **Recommendations** Upgrade Apache Tomcat versions 11.0.0-M1 through 11.0.24 to version 11.0.25. Upgrade Apache Tomcat versions 10.1.0-M1 through 10.1.57 to version 10.1.58. Upgrade Apache Tomcat versions 9.0.0.M1 through 9.0.120 to version 9.0.121. At the moment, there is no information about a newer version that contains a fix for Apache Tomcat versions 8.5.0 through 8.5.100. At the moment, there is no information about a newer version that contains a fix for Apache Tomcat versions 7.0.0 through 7.0.109.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.30 through 7.0.109 **Description** An authentication bypass exists in the DIGEST authenticator. If a client makes a DIGEST authenticated request with a `nonceCount` on the upper boundary of the replay window before `windowSize` requests are made, that request can be replayed once while the associated `nonceCount` remains within the replay window. **Recommendations** Upgrade versions 11.0.0-M1 through 11.0.24 to 11.0.25. Upgrade versions 10.1.0-M1 through 10.1.57 to 10.1.58. Upgrade versions 9.0.0.M1 through 9.0.120 to 9.0.121. At the moment, there is no information about a newer version that contains a fix for this vulnerability for versions 8.5.0 through 8.5.100 and 7.0.30 through 7.0.109.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 **Description** An off-by-one error in the rewrite valves occurs when the `[N]` flag is used. This causes the rewrite processing to restart at the second rule instead of the first rule. **Recommendations** Upgrade Apache Tomcat versions 11.0.0-M1 through 11.0.24 to version 11.0.25. Upgrade Apache Tomcat versions 10.1.0-M1 through 10.1.57 to version 10.1.58. Upgrade Apache Tomcat versions 9.0.0.M1 through 9.0.120 to version 9.0.121.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.25 through 9.0.120 Apache Tomcat versions 8.5.46 through 8.5.100 Apache Tomcat versions 7.0.97 through 7.0.109 **Description** An improper authorization issue exists where `security-role-ref` definitions are incorrectly used as role aliases within the Realm, in addition to their intended use with `Request.isUserInRole()`. **Recommendations** Upgrade versions 11.0.0-M1 through 11.0.24 to 11.0.25. Upgrade versions 10.1.0-M1 through 10.1.57 to 10.1.58. Upgrade versions 9.0.25 through 9.0.120 to 9.0.121.

**Name of the Vulnerable Software and Affected Versions** MySQL Server versions 8.4.0 through 8.4.9 MySQL Server versions 9.0.0 through 9.7.0 MySQL Cluster versions 8.0.11 through 8.0.46 MySQL Cluster versions 8.4.0 through 8.4.9 MySQL Cluster versions 9.0.0 through 9.7.0 **Description** An issue exists in the Server: Connection Handling component. An unauthenticated attacker with network access via multiple protocols can exploit this to cause a hang or a frequently repeatable crash, resulting in a complete Denial of Service (DOS), which is a condition where the service becomes unavailable to legitimate users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Calcite versions 1.5.0 through 1.41 **Description** An unsafe reflection issue exists where externally-controlled input can be used to select classes or code. Specifically, a user-controlled model can load arbitrary classes, which may lead to remote code execution. **Recommendations** Upgrade to version 1.42.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 Apache ActiveMQ Web versions prior to 5.19.7 Apache ActiveMQ Web versions 6.0.0 through 6.2.5 **Description** An improper neutralization of input during web page generation allows for Cross-site Scripting (XSS). The `MessageServlet` in the ActiveMQ web console API copies every JMS message property into an HTTP response header without validation. This allows an attacker to overwrite and inject security headers by setting them on JMS messages returned by the servlet. **Recommendations** Upgrade to version 5.19.7. Upgrade to version 6.2.6. As a temporary mitigation, disable the `MessageServlet` function.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ Broker versions prior to 5.19.7 Apache ActiveMQ Broker versions 6.0.0 through 6.2.5 Apache ActiveMQ All versions prior to 5.19.7 Apache ActiveMQ All versions 6.0.0 through 6.2.5 Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 **Description** Improper input validation and improper control of code generation lead to a code injection issue. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at the '/api/jolokia/' endpoint on the web console. The default access policy allows execution operations on all ActiveMQ MBeans, specifically the `addNetworkConnector(String)` function within `BrokerService`. An authenticated attacker can use a crafted discovery URI to trigger the `brokerConfig` parameter of the VM transport via a "masterslave://" URL. This allows the loading of a Spring XML application context using `ResourceXmlApplicationContext`. Since this context instantiates singleton beans before the configuration is validated, arbitrary code can be executed on the broker's JVM through bean factory methods such as `Runtime.exec()`. **Recommendations** Upgrade Apache ActiveMQ Broker to version 5.19.7 or 6.2.6. Upgrade Apache ActiveMQ All to version 5.19.7 or 6.2.6. Upgrade Apache ActiveMQ to version 5.19.7 or 6.2.6.