n0mi1k

Apache OFBiz: Missing authorization - search-result bulk catalog mutation

Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB

Apache OFBiz: Server-side request forgery in SurveyWrapper

Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles

Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata

Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files

Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants

Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands