Andrea Cosentino

Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching

Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default

Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present

Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml

Apache Camel Karavan: project file name path traversal when committing a project to Git

Apache Shiro: Server-side POST request may be steered to an alternate host

Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection

Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted