Sebastiano Sartor

**Name of the Vulnerable Software and Affected Versions** Eclipse Grizzly versions prior to 5.0.2 **Description** An issue exists where the software cannot properly parse the trailer section in a malformed trailer header line. This flaw can be leveraged to perform HTTP request smuggling, a technique used to interfere with the way a website processes sequences of HTTP requests. **Recommendations** Update to version 5.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.17 **Description** The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery (CSRF) and improper neutralization of special elements used in a template engine. This could potentially enable a remote attacker to perform a server-side request forgery (SSRF) attack. **Recommendations** For versions prior to 18.12.17, upgrade to version 18.12.17 to fix the issue. As a temporary workaround, consider restricting access to vulnerable components until the upgrade can be applied.