Y4Tacker

Qwik is a JavaScript framework where versions before 1.19.2 incorrectly interpreted arrays from dotted form field names during FormData parsing. An attacker could submit mixed array-index and object-property keys for the same path, potentially writing user-controlled properties onto values expected to be arrays. When processing `application/x-www-form-urlencoded` or `multipart/form-data` requests, Qwik City converted dotted field names (e.g., `items.0`, `items.1`) into nested structures. If a path was interpreted as an array, additional attacker-supplied keys—such as `items.toString`, `items.push`, `items.valueOf`, or `items.length`—could alter the server-side value unexpectedly. This could lead to request handling failures, denial of service through malformed array state or oversized lengths, and type confusion in downstream code. The issue affects form parsing in Qwik City request handling and does not require authentication if the vulnerable route is publicly accessible. An attacker can send crafted form submissions that cause parsed input to differ from the application’s expected shape, potentially triggering runtime errors or causing type confusion.

Cursor is a code editor designed for programming with AI. Prior to version 2.0, if a visited website contained maliciously crafted instructions, the model could attempt to follow them to assist the user. When combined with a bypass of the command whitelist mechanism, these indirect prompt injections could result in commands being executed automatically, without the user’s explicit intent, posing a significant security risk.

An observable timing discrepancy exists in Apache Shiro. Before version 2.0.7, the code paths used for non-existent and existing users differ sufficiently, allowing a brute-force attack to determine if a request fails due to an invalid user or an incorrect password by measuring request timing. The most likely attack vector is a local attack. This issue is related to username enumeration, as discussed in the Shiro security model. Brute force attacks can typically be mitigated at the infrastructure level.

Cursor, a code editor for programming with AI, has an issue where, when using OAuth authentication with an untrusted MCP server, an attacker can impersonate a malicious server and inject commands. This can lead to command injection and potential remote code execution. If combined with an untrusted MCP service via OAuth, this could allow arbitrary code execution on the host with full user privileges. The vulnerable process involves interaction during OAuth authentication, where crafted commands are returned by the malicious server. The API endpoint used for OAuth authentication is susceptible to manipulation. The `MCP` server is involved in the authentication process.

The issue is related to the IPAuthenticationProvider in the ZooKeeper Admin Server, which allows for authentication bypass via spoofing. This impacts IP-based authentication and is due to the default configuration using HTTP request headers to detect the client's IP address, specifically honoring the X-Forwarded-For HTTP header. This can be easily spoofed by an attacker, allowing them to bypass authentication. Successful exploitation could lead to information leakage or service availability issues, as Admin Server commands like snapshot and restore can be executed arbitrarily.

This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue.

The issue is related to the exposure of sensitive information to an unauthorized actor. Users are advised to ensure that logs are only available to trusted operators as a temporary measure.

A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was visible to and executable by the account which booted the Derby server. In LDAP-protected databases which weren't also protected by SQL GRANT/REVOKE authorization, this vulnerability could also let an attacker view and corrupt sensitive data and run sensitive database functions and procedures.

The issue is related to the exposure of Remote Code Execution in Apache DolphinScheduler, which can be exploited by a remote attacker to execute arbitrary code. This could potentially lead to complete system compromise, data extraction, and lateral movement within the network. The issue is caused by incorrect code generation management.

The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks can result in unauthorized update, insert, or delete access to some of Oracle WebLogic Server's accessible data, as well as unauthorized read access to a subset of Oracle WebLogic Server's accessible data and the ability to cause a partial denial of service of Oracle WebLogic Server. This is due to insufficient input validation in the Core component.

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3, IIOP to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. It is estimated that millions of servers worldwide are affected, with 166,000 in Brazil alone.

A vulnerability in the Apache Batik library for working with SVG images is related to insufficient checking of incoming requests. This issue allows an attacker to run untrusted Java code from an SVG, potentially enabling remote execution of arbitrary Java code. The estimated impact of this issue is high, with potential exposure of assets in the environment susceptible to exploitation, affecting confidentiality.

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue is related to insufficient checking of incoming requests. The exploitation of this issue may allow a remote attacker to execute arbitrary Java code.

The issue allows a high privileged attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle WebLogic Server, as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and unauthorized read access to a subset of Oracle WebLogic Server accessible data.

The issue is related to an authentication bypass vulnerability in Apache Shiro when forwarding or including via RequestDispatcher.

The issue allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. It is noted that the vendor disputes this, as input to the Pebble templating engine is intended to include arbitrary Java code. The vendor suggests that either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input, as the engine is not responsible for validating the input.

The issue is related to insufficient input validation in the Web Container component of Oracle WebLogic Server, allowing a high-privileged attacker with logon access to the infrastructure to compromise the server. Successful attacks can result in unauthorized access to critical data or all accessible data, including creation, deletion, or modification of data.

A Cross Site Scripting (XSS) issue exists via the `pwg activity` function in `include/functions.inc.php`. This allows for potential malicious script execution.

A Remote Code Execution (RCE) issue exists via the `value[ filename]` in index.php, allowing a malicious user to obtain server control privileges.