n0mi1k

Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints

Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint

Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

Apache Struts: Shared message formatter exposes date and time values across concurrent requests

Apache Struts: Unbounded request body read in the REST plugin

Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation

Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit