Zszsec

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.

**Name of the Vulnerable Software and Affected Versions** DbGate versions prior to 7.2.6 DbGate versions prior to 7.3.2-premium-beta.1 **Description** A path traversal issue exists in the files-style endpoint. Remote attackers can manipulate the `filePath/uri` argument used by the `fs.readFile()` function within the `packages/api/src/controllers/files.js` file to access unauthorized files on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi version 2.11.0 **Description** An authorization flaw exists in the REST API methods used to list migration sources and submit migration requests when moving version-controlled Process Group contents into a Connector. The system only verified permissions for the target Connector, failing to evaluate access rights for the involved Process Groups. This allows an authenticated user with read access to a Connector to enumerate identifiers, names, and flow registry details of Process Groups they are not authorized to read. Additionally, a user with write access to a Connector can migrate a Process Group they do not have write access to, which copies the flow definition, referenced assets, and component state into the Connector while disabling and renaming the source Process Group. This issue does not affect installations that do not use component-level authorization policies for Process Groups. The migration process requires the source Process Group to be stopped with empty queues and does not include sensitive property values. **Recommendations** Upgrade to version 2.12.0.