n0mi1k

Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit

Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

Apache Roller: XML external entity processing in OPML bookmark import

Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint