Apache StreamPark: maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

PT-2020-19647 · Querymen · Querymen

Name of the Vulnerable Software and Affected Versions: querymen versions prior to 2.1.4 Description: The issue allows modification of object properties due to a lack of sanitization in the parameters of the exported function handlertype, name, fn, which can be controlled by users. This could be...

PT-2011-4552 · Red Hat · Freeipa +1

Name of the Vulnerable Software and Affected Versions: FreeIPA versions prior to 2.1.4 Description: A cross-site request forgery CSRF issue exists in the management interface, allowing remote attackers to hijack the authentication of administrators for requests that make configuration changes...