Lokerxx

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions prior to 2.4.68 **Description** Improper Privilege Management allows local .htaccess authors to read files using the privileges of the httpd user. **Recommendations** Upgrade to version 2.4.68.

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ Broker versions prior to 5.19.7 Apache ActiveMQ Broker versions 6.0.0 through 6.2.5 Apache ActiveMQ All versions prior to 5.19.7 Apache ActiveMQ All versions 6.0.0 through 6.2.5 Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 **Description** Improper input validation and improper control of code generation allow for code injection. The software exposes the Jolokia JMX-HTTP bridge at the '/api/jolokia/' endpoint. The default access policy permits execution operations on ActiveMQ MBeans, specifically the `BrokerService.addNetworkConnector(String)` and `BrokerService.addConnector(String)` functions. An authenticated attacker can use a crafted discovery URI, such as `masterslave:vm://...,...` or `static:vm://...`, to trigger the `brokerConfig` parameter of the VM transport. This causes the `ResourceXmlApplicationContext` to load a remote Spring XML application context. Since singleton beans are instantiated before configuration validation, arbitrary code can be executed on the broker's JVM via bean factory methods like `Runtime.exec()`. **Recommendations** Upgrade Apache ActiveMQ Broker versions prior to 5.19.7 to 5.19.7. Upgrade Apache ActiveMQ Broker versions 6.0.0 through 6.2.5 to 6.2.6. Upgrade Apache ActiveMQ All versions prior to 5.19.7 to 5.19.7. Upgrade Apache ActiveMQ All versions 6.0.0 through 6.2.5 to 6.2.6. Upgrade Apache ActiveMQ versions prior to 5.19.7 to 5.19.7. Upgrade Apache ActiveMQ versions 6.0.0 through 6.2.5 to 6.2.6.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.21 Apache Tomcat versions 10.1.0-M1 through 10.1.54 Apache Tomcat versions 9.0.2 through 9.0.117 Apache Tomcat versions 8.5.24 through 8.5.100 Apache Tomcat versions 7.0.83 through 7.0.109 **Description** An issue exists where the HTTP Authentication Header is exposed to unexpected hosts during WebSocket authentication. **Recommendations** Upgrade versions 11.0.0-M1 through 11.0.21 to 11.0.22. Upgrade versions 10.1.0-M1 through 10.1.54 to 10.1.55. Upgrade versions 9.0.2 through 9.0.117 to 9.0.118.