CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26579 – Apache Inlong JDBC Vulnerability
https://notcve.org/view.php?id=CVE-2024-26579
Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] to solve it. [1] https://github.com/apache/inlong/pull/9694 [2] https://github.com/apache/inlong/pull/9707 Vulnerabilidad de deserialización de datos no confiables en Apache InLong. Este problema afecta a Apache InLong: desde 1.7.0 hasta 1.11.0, los atacantes pueden eludir el uso de parámetros maliciosos. Se recomienda a los usuarios actualizar a Apache InLong 1.12.0 o seleccionar [1], [2] para resolverlo. [1] https://github.com/apache/inlong/pull/9694 [2] https://github.com/apache/inlong/pull/9707 • http://www.openwall.com/lists/oss-security/2024/05/09/2 https://github.com/advisories/GHSA-fgh3-pwmp-3qw3 https://lists.apache.org/thread/d2hndtvh6bll4pkl91o2oqxyynhr54k3 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.1EPSS: 87%CPEs: 1EXPL: 4CVE-2024-32113 – Apache OFBiz Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2024-32113
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue. Limitación inadecuada de una vulnerabilidad de nombre de ruta a un directorio restringido ("Path Traversal") en Apache OFBiz. Este problema afecta a Apache OFBiz: antes del 18.12.13. Se recomienda a los usuarios actualizar a la versión 18.12.13, que soluciona el problema. Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. • https://www.exploit-db.com/exploits/52020 https://github.com/Mr-xn/CVE-2024-32113 https://github.com/RacerZ-fighting/CVE-2024-32113-POC https://github.com/YongYe-Security/CVE-2024-32113 http://www.openwall.com/lists/oss-security/2024/05/09/1 https://issues.apache.org/jira/browse/OFBIZ-13006 https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd https://ofbiz.apache.org/download.html https://ofbiz.apache.org/security.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2024-4030 – tempfile.mkdtemp() may be readable and writeable by all users on Windows
https://notcve.org/view.php?id=CVE-2024-4030
On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions. En Windows, un directorio devuelto por tempfile.mkdtemp() no siempre tendría permisos configurados para restringir la lectura y escritura en el directorio temporal por parte de otros usuarios, sino que normalmente heredaría los permisos correctos de la ubicación predeterminada. • https://github.com/python/cpython/commit/35c799d79177b962ddace2fa068101465570a29a https://github.com/python/cpython/commit/5130731c9e779b97d00a24f54cdce73ce9975dfd https://github.com/python/cpython/commit/66f8bb76a15e64a1bb7688b177ed29e26230fdee https://github.com/python/cpython/commit/6d0850c4c8188035643586ab4d8ec2468abd699e https://github.com/python/cpython/commit/81939dad77001556c527485d31a2d0f4a759033e https://github.com/python/cpython/commit/8ed546679524140d8282175411fd141fe7df070d https://github.com/python/cpython/commit/91e3669e01245185569d09e9e6e11641282971ee https://github. • CWE-276: Incorrect Default Permissions •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28148 – Apache Superset: Incorrect datasource authorization on explore REST API
https://notcve.org/view.php?id=CVE-2024-28148
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Un usuario autenticado podría acceder a los metadatos de una fuente de datos para la que no está autorizado a ver enviando una solicitud de API REST específica. Este problema afecta a Apache Superset: anterior a 4.0.0. Se recomienda a los usuarios actualizar a la versión 4.0.0, que soluciona el problema. • https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4536 – Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability
https://notcve.org/view.php?id=CVE-2024-4536
In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component ( https://github.com/eclipse-edc/Connector ) regarding the OAuth2-protected data sink feature. When using a custom, OAuth2-protected data sink, the OAuth2-specific data address properties are resolved by the provider data plane. Problematically, the consumer-provided clientSecretKey, which indicates the OAuth2 client secret to retrieve from a secrets vault, is resolved in the context of the provider's vault, not the consumer. This secret's value is then sent to the tokenUrl, also consumer-controlled, as part of an OAuth2 client credentials grant. The returned access token is then sent as a bearer token to the data sink URL. This feature is now disabled entirely, because not all code paths necessary for a successful realization were fully implemented. • https://github.com/eclipse-edc/Connector/commit/a4e6018d2c0457fba6f672fafa6c590513c45d1b https://github.com/eclipse-edc/Connector/releases/tag/v0.6.3 https://gitlab.eclipse.org/security/cve-assignement/-/issues/22 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/198 • CWE-201: Insertion of Sensitive Information Into Sent Data CWE-522: Insufficiently Protected Credentials •