Nbxiglk

**Name of the Vulnerable Software and Affected Versions** Apache Geode versions prior to 1.15.2 **Description** A malicious script injection issue exists in the Apache Geode web-api (REST). An attacker can trick a logged-in user into clicking a specially-crafted link, leading to code execution on the returned page. This could result in the theft of the user's session information and potential account takeover. The vulnerability impacts the REST API. **Recommendations** Upgrade to version 1.15.2, which resolves the issue.

Name of the Vulnerable Software and Affected Versions: Apache IoTDB versions 1.0.0 through 1.3.3 Description: The issue is related to a Remote Code Execution vulnerability with untrusted URI of UDF in Apache IoTDB. An attacker with privilege to create UDF can register a malicious function from an untrusted URI. Recommendations: For Apache IoTDB versions 1.0.0 through 1.3.3, upgrade to version 1.3.4, which fixes the issue. As a temporary workaround, consider restricting the creation of UDFs to trusted sources until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** Apache Zeppelin versions prior to 0.11.1 **Description** The issue is related to improper control of code generation, allowing an attacker to inject sensitive configuration or malicious code when connecting to a MySQL database via a JDBC driver. **Recommendations** For Apache Zeppelin versions prior to 0.11.1, upgrade to version 0.11.1 to fix the issue. As a temporary workaround, consider restricting access to the JDBC driver or disabling the code generation feature until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler (affected versions not specified) **Description** The issue concerns an Improper Input Validation vulnerability, allowing an authenticated user to execute arbitrary, unsandboxed javascript on the server. This can lead to arbitrary js execution as root for authenticated users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache InLong versions 1.4.0 through 1.8.0 **Description** The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability allows some sensitive parameter checks to be bypassed, including `autoDeserizalize` and `allowLoadLocalInfile`. **Recommendations** For Apache InLong versions 1.4.0 through 1.8.0, upgrade to Apache InLong's 1.9.0 or cherry-pick the provided patch to solve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache XML Graphics Batik version 1.16 **Description** The issue is related to a Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. This vulnerability can be exploited by a malicious SVG, which could trigger the loading of external resources by default, causing resource consumption or, in some cases, information disclosure. **Recommendations** For Apache XML Graphics Batik version 1.16, upgrade to version 1.17 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable component to minimize the risk of exploitation. Avoid using the vulnerable version of Apache XML Graphics Batik until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 0.0.2 through 1.22.0 **Description** The issue is related to the Remote Resource Handler component of Apache NiFi, which is associated with incorrect code generation management. This can allow a remote attacker to execute arbitrary code. The vulnerability is exploited when an authenticated and authorized user configures a location that enables custom code execution, using HTTP URL references for retrieving drivers in Processors and Controller Services. **Recommendations** For Apache NiFi versions 0.0.2 through 1.22.0, upgrade to Apache NiFi 1.23.0 to mitigate the issue. This version introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users.

**Name of the Vulnerable Software and Affected Versions** Apache Flume versions 1.4.0 through 1.10.1 **Description** The issue allows for a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This is due to the JMSSource class being configured with a `providerUrl` parameter, which performs a JNDI lookup without validation, potentially leading to the deserialization of untrusted data. **Recommendations** For Apache Flume versions 1.4.0 through 1.10.1, update to version 1.11.0 to fix the issue by limiting JNDI to allow only the use of the java protocol or no protocol.