Audrey Budryte

**Name of the Vulnerable Software and Affected Versions** Klaw versions prior to 2.10.2 **Description** Klaw, a self-service Apache Kafka Topic Management/Governance tool/portal, contains an improper access control issue. This allows unauthorized users to trigger a reset or deletion of metadata for any tenant. An attacker can send a crafted request to the `/resetMemoryCache` API endpoint to clear cached configurations, environments, and cluster data. The `resetMemoryCache` function is vulnerable to this manipulation. **Recommendations** Update to version 2.10.2 or later.

**Name of the Vulnerable Software and Affected Versions** Kafka Connect BigQuery Connector versions prior to 2.11.0 **Description** The Kafka Connect BigQuery Connector, a sink connector from Apache Kafka to Google BigQuery, contains a flaw that could allow arbitrary file reads. This occurs because the service does not validate externally-sourced credential configurations before passing them to authentication libraries. An attacker can exploit this by providing a malicious credential configuration containing crafted `credential source.file` paths or `credential source.url` endpoints, potentially leading to arbitrary file reads or Server-Side Request Forgery (SSRF) attacks. The connector requires Google Cloud credential configurations for authentication to BigQuery services. **Recommendations** Upgrade to version 2.11.0 or later.

**Nome do software vulnerável e versões afetadas** Express OpenID Connect, versões 2.3.0 a 2.5.1 **Descrição** O problema decorre da falha na regeneração do ID de sessão e do cookie de sessão quando um usuário faz login, tornando o aplicativo suscetível a vulnerabilidades de fixação de sessão. Esse comportamento afeta as versões anteriores ao lançamento da correção. **Recomendações** Para as versões 2.3.0 a 2.5.1, atualize para a versão 2.5.2 ou posterior para resolver o problema.