Qing Xu

An issue exists involving the inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling. This occurs via the `mod proxy uwsgi` module when processing a crafted uwsgi response that utilizes the `Transfer-Encoding` header.

Improper handling of insufficient permissions or privileges allows for potential unauthorized access or actions within the system.

The issue is related to improper input validation, allowing attackers to execute malicious queries by setting improper configuration properties to LDAP search filter.

The issue is related to session fixation, where a session remains valid after a password change. This could potentially allow unauthorized access. Users are advised to upgrade to a version that fixes this issue.

The issue is related to the exposure of sensitive information to an unauthorized actor in Apache Solr. Solr Streaming Expressions allows users to extract data from other Solr Clouds using a `zkHost` parameter. When the original SolrCloud is set up to use ZooKeeper credentials and ACLs, they will be sent to whatever `zkHost` the user provides. An attacker could set up a server to mock ZooKeeper, accepting ZooKeeper requests with credentials and ACLs, and extract sensitive information. Then, they could send a streaming expression using the mock server's address in `zkHost`. Streaming Expressions are exposed via the "/streaming" handler with "read" permissions.

An attacker can use SnakeYAML to deserialize `java.net.URLClassLoader` and make it load a JAR from a specified URL, and then deserialize `javax.script.ScriptEngineManager` to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation.

The issue allows an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. This enables the end-user to enter javascript or similar, which would be executed. The inputted strings are now properly escaped when rendered.