Sho Odagiri

Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.

Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.

An issue exists where unauthenticated attackers can read theme templates and metadata. This is possible through a file extension filtering bypass, where attackers utilize URL encoding to circumvent extension validation and access sensitive theme files.

Improper Restriction of Security Token Assignment occurs when administrative tokens are not invalidated after an administrator account is suspended, deleted, or deactivated. This allows continued access to administrative APIs until the token expires.

Timeline-related APIs lack proper authorization checks, which allows authenticated users to access content that is private, deleted, or unapproved, as well as its associated revision history. This leads to the exposure of private personal information to unauthorized actors.

Improper Neutralization of Alternate XSS Syntax occurs when AI-generated response content is rendered in the browser without proper sanitization. This allows malicious scripts to be executed when the content is viewed. Cross-Site Scripting (XSS) is a flaw where an attacker injects malicious scripts into content delivered to other users.

Improper Authentication issue in Apache OFBiz where cookie manipulation allows authenticated JWT (JSON Web Token) forgery and account impersonation.

Improper Neutralization of Input During Web Page Generation leads to a Reflected Cross-site Scripting (XSS) issue. This occurs due to improper HTML attribute escaping within Layered-Modal Dialog parameters.

Improper neutralization of special elements used in a template engine allows for potential exploitation. This occurs when the system fails to properly sanitize input used within the template engine, which can lead to Server-Side Template Injection (SSTI), a condition where an attacker can inject malicious code into a template that is then executed on the server.

Server-Side Request Forgery (SSRF) in the Content component operations. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Improper Input Validation in Apache OFBiz allows for JSON Attribute Override and URL Allowlist Bypass, which can lead to Remote Code Execution.

Apache OFBiz contains issues involving improper neutralization of input during web page generation, improper limitation of a pathname to a restricted directory, and improper control of generation of code. These flaws allow for Cross-site Scripting (XSS), Path Traversal, and Code Injection, specifically within the Catalog Manager, which can lead to arbitrary file write, stored XSS, and Remote Code Execution (RCE).

Improper Neutralization of Special Elements used in an Expression Language Statement, also known as Expression Language Injection, exists in Apache OFBiz. This issue involves a FreeMarker Server-Side Template Injection (SSTI), which is a vulnerability where an attacker can inject malicious code into a template that is then executed on the server, potentially leading to unauthorized command execution.

A cross-site scripting issue exists where the administration page does not properly sanitize file information. If a file containing malicious content is uploaded, an arbitrary script may be executed in the web browser of a user viewing the file information page.

A cross-site request forgery (CSRF) issue exists in Musetheque V4 Information Disclosure. This occurs when a logged-in user visits a malicious page, which can lead to the execution of unexpected operations.

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 5.0 through 5.0.6 Description A privilege escalation issue exists in Apache Cassandra 5.0 when using MutualTlsAuthenticator in an mTLS environment. A user with only CREATE permission can associate their own certificate identity with an arbitrary role, including a superuser role, and authenticate as that role via the ADD IDENTITY function. Recommendations Upgrade to version 5.0.7 or later.

The GROWI OpenAI thread/message API endpoints do not perform proper authorization checks. A logged-in user who has access to a shared AI assistant's identifier can potentially view and modify other users' threads and messages. The affected API endpoints allow unauthorized access to sensitive data and potential tampering with user communications.

Metabase is a data analytics platform where authenticated users could retrieve sensitive information, including database access credentials. A low-privileged user can extract sensitive information, such as database credentials, and include it in the email body through template evaluation. The issue involves access to vulnerable endpoints.

An issue exists in Apache Answer where an unauthenticated API endpoint incorrectly exposes the full revision history of deleted content. This allows an unauthorized user to retrieve restricted or sensitive information. Approximately 8.5K services are estimated to be affected worldwide. The vulnerable endpoint allows access to data that should be restricted.

When directory listing is enabled, file and directory names are inserted into generated HTML without proper escaping in the `href`, `title`, and `link` attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.