n0mi1k

Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

Apache Roller: XML external entity processing in OPML bookmark import

Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10