meifukun

Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

Apache Roller: WSSE digest authentication headers can be replayed

Apache Roller: OAuth authorization endpoint trusts request-supplied identity

Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Apache Roller: XML external entity processing in trackback response parser

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

Apache Roller: Anonymous setup action allows frontpage configuration tampering