n0mi1k

Apache Roller: XML external entity processing in OPML bookmark import

Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers

Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder

Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder