n0mi1k

Apache OFBiz: XML external entity injection (XXE)

Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

Apache Axis2/Java: Unbounded multipart and form-encoded request bodies

Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page

Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client

Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling

Apache OFBiz: Missing authorization - catalog quick-admin product writes

Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services

Apache OFBiz: Authorization bypass - self-grant content OWNER