Thesecguy45

**Name of the Vulnerable Software and Affected Versions** Spring Cloud Gateway versions 5.0.0 through 5.0.2 Spring Cloud Gateway versions 4.3.0 through 4.3.5 Spring Cloud Gateway versions 4.0.0 through 4.2.9 Spring Cloud Gateway versions 3.1.13 and earlier **Description** The `JsonToGrpcGatewayFilterFactory` allows the use of arbitrary Spring Resource locations when defining the proto descriptor. A proto descriptor is a file that describes the structure of the data and the services provided by a gRPC server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1 **Description** The JavaScript task runner shares a single module cache across all users' Code-node executions. In multi-user instances where the JS task runner has built-in or external modules enabled, a user can poison a cached module. This allows the attacker to alter the executions of other users on the same runner, compromising confidentiality, integrity, or availability. This issue represents a cross-user isolation break within a single instance and is not a sandbox escape or remote code execution. **Recommendations** Update to version 1.123.67 or later. Update to version 2.31.5 or later. Update to version 2.32.1 or later.

**Name of the Vulnerable Software and Affected Versions** NATS Server versions prior to 2.14.1 NATS Server versions prior to 2.12.9 **Description** An MQTT client can include protocol control characters in subscription filters. These characters are subsequently forwarded as NATS protocol data to route or leafnode connections, which corrupts the forwarded protocol stream and enables the injection of unintended NATS protocol operations. **Recommendations** Update NATS Server to version 2.14.1 or later. Update NATS Server to version 2.12.9 or later.

**Name of the Vulnerable Software and Affected Versions** Ray versions prior to 2.56.0 **Description** An unsafe deserialization issue exists in the WebDataset reader. An attacker can achieve remote code execution by providing a malicious tar archive to the `read webdataset()` function. The ` default decoder()` function in webdataset datasource.py unconditionally calls `pickle.loads()` on tar entries with .pkl or .pickle extensions and `torch.load()` with `weights only=False` on .pt or .pth entries. This results in the execution of arbitrary code within Ray remote workers on every worker that processes the malicious archive. Deserialization is the process of converting a data format back into an object, which becomes unsafe when untrusted data is processed without validation. **Recommendations** Update to version 2.56.0 or later. As a temporary mitigation, avoid using the `read webdataset()` function with untrusted tar archives.

**Name of the Vulnerable Software and Affected Versions** Kestra versions prior to 1.0.43 Kestra versions prior to 1.3.19 **Description** An authenticated user can perform a path traversal attack to read arbitrary files on the host filesystem that the process has access to, such as /etc/passwd or mounted secrets. This occurs because several API endpoints accept a `kestra://` URI and use the `StorageInterface.parentTraversalGuard` function, which only inspects the literal string. By using a URL-encoded sequence `%2E%2E` (representing `..`), an attacker can bypass this guard. The subsequent call to `URI.getPath()` decodes the sequence, and the resulting path is processed by `Paths.get()` without normalization, allowing the operating system to resolve the parent directory segments during the file open operation. **Recommendations** Update to version 1.0.43. Update to version 1.3.19.