Sławomir Zakrzewski

**Name of the Vulnerable Software and Affected Versions** MLflow versions prior to 3.10.1 **Description** An authorization bypass exists in the AJAX endpoint used to download saved model artifacts. Due to missing access-control validation, a user without permissions to a specific experiment can directly query this endpoint to retrieve model artifacts they are not authorized to access. **Recommendations** Update to a version newer than 3.10.1.

Name of the Vulnerable Software and Affected Versions MLflow versions through 3.10.1 Description MLflow is susceptible to Stored Cross-Site Scripting (XSS) due to unsafe parsing of YAML-based MLmodel artifacts within its web interface. An authenticated attacker can upload a malicious MLmodel file that executes when another user views the artifact in the UI, potentially leading to session hijacking or unauthorized actions performed on behalf of the victim. Additionally, an authorization bypass exists in the AJAX endpoint used for downloading saved model artifacts. Missing access-control validation allows a user without appropriate permissions to directly query this endpoint and retrieve model artifacts they are not authorized to access. Recommendations Update MLflow to a version later than 3.10.1.

**Name of the Vulnerable Software and Affected Versions** Fantastical versions prior to 4.0.16 **Description** A flaw exists in the XPC services of Fantastical where proper client authorization checks were not implemented in the `listener:shouldAcceptNewConnection` method. This allowed any local, unprivileged process to connect to the XPC service and access its methods. **Recommendations** Update to version 4.0.16 or later.

Name of the Vulnerable Software and Affected Versions: OpenShift (affected versions not specified) Description: A denial of service (DoS) issue was found in OpenShift, related to the GraphQL batching functionality. This allows attackers to send multiple queries within a single request, potentially submitting a request with thousands of aliases in one query. The issue leads to excessive resource consumption, causing application unavailability for legitimate users. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GraphQL (affected versions not specified) Description: A vulnerability was found in GraphQL due to improper access controls on the `graphql introspection query`. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `graphql introspection query` to minimize the risk of exploitation. Apply available patches immediately to mitigate risks.

**Name of the Vulnerable Software and Affected Versions** LuckyWP Table of Contents WordPress plugin versions 2.1.4 and earlier **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, for example, in a multisite setup. **Recommendations** For LuckyWP Table of Contents WordPress plugin versions 2.1.4 and earlier, update to a version that addresses the sanitization and escaping of settings to prevent Stored Cross-Site Scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Site Reviews WordPress plugin versions prior to 7.0.0 **Description** The issue allows an attacker to manipulate client IP addresses retrieved from potentially untrusted headers, which can be used to bypass IP-based blocking. **Recommendations** For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Enterprise Architect version 16.0.1605 **Description** The issue allows attackers to run arbitrary SQL commands via the `Find` parameter in the Select Classifier dialog box. This can be exploited by attackers to execute unauthorized SQL queries. **Recommendations** For Enterprise Architect version 16.0.1605, consider restricting access to the Select Classifier dialog box until a patch is available. As a temporary workaround, avoid using the `Find` parameter in the affected dialog box to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Easy Forms for Mailchimp WordPress plugin versions 6.8.10 and earlier **Description** The issue concerns the lack of proper sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as administrators, to perform Cross-Site Scripting attacks. This is possible even when the unfiltered html capability is disallowed. **Recommendations** For Easy Forms for Mailchimp WordPress plugin versions 6.8.10 and earlier, update to a version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Software versions prior to 11.1.x **Description** The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint "/sofer/DocumentService.asc/SaveAnnotation", where input data transmitted via the POST method in the parameters `author` and `text` are not adequately sanitized and validated. This allows for the injection of malicious JavaScript code. The vulnerability was identified in the function for adding new annotations while editing document content. **Recommendations** For versions prior to 11.1.x, update to a version above 11.1.x to resolve the issue. As a temporary workaround, consider restricting access to the "/sofer/DocumentService.asc/SaveAnnotation" endpoint or disabling the function for adding new annotations until a patch is available. Avoid using the parameters `author` and `text` in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WordPress Online Booking and Scheduling Plugin versions prior to 22.5 **Description** The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in multisite setups. This is due to the plugin not sanitizing and escaping some of its settings. **Recommendations** For versions prior to 22.5, update to version 22.5 or later to resolve the issue. As a temporary workaround, consider restricting the ability of high privilege users to access and modify the plugin's settings until the update is applied.