Eclipse Kura versions 5.4.0 through 5.6.2 contain an improper privilege management vulnerability in the Identity REST APIs. Authenticated users with the rest.identity permission, but without administrative rights, can escalate their privileges to full administrator by assigning permissions to themselves or others, changing passwords, deleting identities, and modifying permissions. This flaw allows attackers to lock out legitimate administrators. The issue is resolved in version 5.6.3.
Apache TomEE versions from 10.1.1 up to but not including 10.3.0, and from 11.0.0-M1 up to but not including 11.0.0-M2, running on JDK 21 or later, skip EJB method authorization checks. This allows callers to invoke EJB methods without enforcement of configured access restrictions. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE's embedded OpenEJB HTTP server does not limit the size of incoming request bodies or multipart requests and fails to remove temporary files created for multipart parts. This can allow a remote unauthenticated attacker to cause excessive memory or disk usage, resulting in denial of service. Deployments using Tomcat connectors are not affected. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.
Apache TomEE contains a vulnerability where the remote EJB client does not verify that the server's hostname matches the TLS certificate. This allows an attacker intercepting network traffic to impersonate the server and potentially read or modify sensitive data including credentials and invocation information. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
Apache TomEE's embedded Derby network service ignores its configured bind address and listens on all network interfaces. This allows remote attackers with network access to connect to the database server and read or modify data. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Apache TomEE versions from 4.0.0-beta-1 through 4.7.5, 7.0.0-M1 through 10.0.0-M1, 10.0.0-M1 through 10.3.0, and 11.0.0-M1 through 11.0.0-M2 contain a vulnerability where the EJBd remote protocol exposes datasource connection details, including database credentials, to remote clients. This allows remote clients with access to the EJBd endpoint to retrieve database credentials and connect directly to the database. The issue is fixed in Apache TomEE versions 10.3.0 and 11.0.0-M2.
CVE-2026-108187 is an origin validation error vulnerability in Zoom Workplace for Windows that allows an unauthenticated attacker to escalate privileges via network access. The flaw affects versions prior to 7.1.5 and has a high severity rating with a CVSS score of 8.1. A fix is available in version 7.1.5.
Apache TomEE versions using the embedded HTTP server to serve Hessian remoting endpoints silently ignore configured authentication and transport security. This allows remote unauthenticated attackers to invoke exposed EJB methods without credentials or encryption. The issue affects deployments relying on the embedded HTTP server rather than Tomcat. Users should block network access to Hessian endpoints from untrusted clients or migrate to a different remoting protocol.
Apache TomEE versions using the Hessian protocol to expose EJBs may silently bypass configured authentication and transport security settings, allowing remote unauthenticated attackers to invoke exposed EJB methods. This affects deployments that use the Hessian module with such configurations. Users are advised to restrict network access to Hessian endpoints or migrate to other remoting protocols. A fix is available starting from version 10.0.0-M1.
CVE-2026-97874 is an improper authentication vulnerability in Apache TomEE when using Hessian remoting with BASIC authentication. The authentication check is bypassed for Hessian endpoints of applications deployed under a non-root context path, allowing remote unauthenticated attackers to invoke exposed EJB methods without credentials. Users are advised to restrict network access to these endpoints or migrate to a different remoting protocol.
CVE-2026-121683 is a critical vulnerability in Ivanti Cloud Services Application version 5.0.8 where missing authentication allows a remote unauthenticated attacker to add and delete trusted EPM Core certificate entries.
Eclipse Kura has a vulnerability where it downloads deployment packages (DPs) from remote URLs without limiting the size of the data received. This can allow an attacker controlling the server or tampering with HTTP downloads to cause the device to exhaust local storage or memory, leading to denial of service conditions such as failed configuration persistence, failed logging, and potential crashes of the framework or other services. The REST upload endpoint also lacks size limits on uploads. Workarounds include restricting package installation to trusted HTTPS sources and limiting who can install packages via permissions.
Stateful session bean identifiers are generated using a non-cryptographically secure random source, allowing a remote attacker with a valid identifier to derive others and access or modify other users' session state. Upgrading to versions 10.3.0 or 11.0.0-M2 mitigates this issue.
The bundled JAAS login modules have a vulnerability that leaks information about whether a username exists and perform credential comparisons in a non-constant-time manner. This allows a remote unauthenticated attacker to enumerate valid accounts and potentially infer credential material through timing analysis. The issue is fixed in versions 10.3.0 and 11.0.0-M2.
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading.
Eclipse Kura versions 5.0.0 through 5.6.2 contain a vulnerability in the Wire Graph update functionality of the Kura Web UI and the Wire Service REST API v1. An authenticated user with only Wires management permissions can modify or replace configurations of components outside the Wire Graph, including security-relevant components. This can lead to escalation to full administrative privileges and potential device disruption. The vulnerability requires at least one Driver installed on the device. The issue is fixed in version 5.6.3.
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary applications and execute code. Only installations that enabled the system applications and a remote EJB endpoint are exposed. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.