Threedr3Am

The issue exists due to insufficient validation of user-input data in the UriComponentsBuilder component of the Spring Framework. This can allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack. The vulnerability poses risks to systems, potentially exposing them to open redirect and SSRF attacks. Approximately 1,139,824 results are mainly distributed in China, the United States, and other countries.

The issue is related to Server-side request forgery (SSRF). This means an attacker can potentially trick the server into making requests to unintended locations, which could lead to unauthorized access or information disclosure.

The issue is related to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object. This occurs when the object receives parsed string data from the org.h2.jdbc.JdbcResultSet.getSQLXML() method and executes the getSource() method with the parameter `DOMSource.class`. The vulnerability allows a remote attacker to conduct XXE attacks due to incorrect restriction of XML external entity references.

The issue affects applications that use both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf`. It exposes a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at "/hystrix/monitor;[user-provided data]", the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.

The issue is related to errors in processing input data in the web component of Essbase Analytic Provider Services. It can be exploited by a remote attacker to cause a denial of service. Successful attacks can result in the ability to cause the service to hang or crash repeatedly, leading to a complete denial of service.

The issue exists due to insufficient input validation in the Core component of Oracle Coherence, allowing a remote attacker to cause the device to hang or deny service. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle Coherence. The vulnerability can be exploited via T3, IIOP by an unauthenticated attacker with network access.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can be exploited by a remote attacker using the T3 protocol to cause a denial of service, potentially leading to a hang or crash of the Oracle WebLogic Server. The vulnerability can be easily exploited by an unauthenticated attacker with network access via T3 or IIOP protocols.

The issue is related to insufficient input validation in the Workflow Notification Mailer component of Oracle Workflow. This allows a low-privileged attacker with network access via HTTP to compromise Oracle Workflow, resulting in unauthorized read access to a subset of Oracle Workflow accessible data.

The issue is related to the Web Services component of Oracle WebLogic Server, which can be exploited by an unauthenticated attacker with network access via T3 or IIOP protocols. This can lead to a denial of service (DOS) condition, causing the server to hang or crash repeatedly. The vulnerability is due to incorrect resource cleanup or release.

The issue exists due to insufficient input validation in the Core component of Oracle Coherence. It can be exploited by a remote attacker using a specially crafted T3 protocol network request, potentially causing the device to hang or resulting in a denial of service. The vulnerability can be exploited via T3 or IIOP protocols.

Name of the Vulnerable Software and Affected Versions: Nacos versions prior to 1.4.1 Description: The issue affects Nacos, a platform for dynamic service discovery and configuration and service management. In affected versions, the ConfigOpsController allows users to perform management operations like querying the database or wiping it out. The `/derby` endpoint is not protected and can be accessed by unauthenticated users, while the `/data/remove` endpoint is properly protected. This issue only affects installations using embedded storage (derby DB) and not those using external storage (e.g., mysql). Additionally, when configured to use authentication, Nacos has a backdoor that enables servers to bypass authentication checks by spoofing the `user-agent` HTTP header. This may allow any user to carry out administrative tasks on the Nacos server. Recommendations: For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `/derby` endpoint and disabling the use of embedded storage (derby DB) if possible. Additionally, restrict access to the `configuration` endpoint to minimize the risk of exploitation. Avoid using the `Nacos-Server` user-agent header to bypass authentication checks.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. The vulnerability can be exploited using network protocols IIOP and T3.

Nacos is a platform for dynamic service discovery, configuration, and service management. When configured to use authentication via `-Dnacos.core.auth.enabled=true`, the system employs the `AuthFilter` servlet filter to enforce security. This filter contains a backdoor that allows authentication checks to be bypassed by spoofing the `user-agent` HTTP header. An attacker can exploit this by using the `Nacos-Server` value in the `user-agent` header to gain unauthorized access and perform administrative tasks. Additionally, the `/derby` endpoint within the `ConfigOpsController` is not protected by the `@Secured` annotation, allowing unauthenticated users to execute SQL queries against the embedded Derby database via the `sql` parameter. This specific issue affects only installations using embedded storage.

The issue allows malicious users to construct file names for directory traversal, enabling them to traverse to other directories and download files.

The issue allows bypassing the "Sensitive Headers" restriction when executing requests with specially constructed URLs. Applications using Spring Security's StrictHttpFirewall are not affected, as they reject requests that allow bypassing.