The IT Show

Security · Oppia Oppia

Oppia through 3.5.2 Exposes Admin Role Data to Any Logged-In User

Oppia versions through 3.5.2 decorate the AdminRoleHandler GET endpoint in core/controllers/admin.py with open_access, allowing any registered user to query it without authorization. Using filter_criterion parameters, attackers can enumerate usernames holding specific roles, banned flags, and managed topic identifiers.

Security · Remix React Router

React Router patches client-side script execution flaw in loader and action redirects (CVE-2026-22029)

React Router maintainers fixed CVE-2026-22029, in which SPA redirects returned from loaders or actions in Framework, Data, or unstable RSC modes could produce unsafe URLs leading to unintended JavaScript execution in the browser; the issue affects @remix-run/router before 1.23.2 and react-router 7.0.0 through 7.11.0, as well as Remix v1/v2, and requires redirect paths built from untrusted content or an open redirect. Fixes are available in @remix-run/router 1.23.2 and react-router 7.12.0, and applications using Declarative Mode are not impacted.

Security · Red Hat Undertow

Undertow Flaw (CVE-2024-5971) Causes Chunked Responses to Hang, Enabling Denial of Service

CVE-2024-5971 describes a vulnerability in Undertow where a chunked response hangs after the body is flushed because the expected 0\r\n chunk terminator is never sent, leaving clients waiting and causing uncontrolled resource consumption that can result in denial of service; the issue occurs only in Java 17 TLSv1.3 scenarios. Related advisories cover additional Undertow issues, including CVE-2024-3884 (OutOfMemory on large form-urlencoded data), CVE-2025-9784 ("MadeYouReset" server-side stream resets that bypass abuse counters), and CVE-2025-12543 (improper Host header validation in the Undertow HTTP server core used by WildFly and JBoss EAP).

Security · GNU Emacs

Emacs Command Injection Flaw (CVE-2025-1244) Allows Remote Shell Command Execution

CVE-2025-1244 is a command injection vulnerability in the GNU Emacs text editor that could let a remote, unauthenticated attacker run arbitrary shell commands, exploited by tricking a user into visiting a specially crafted website or an HTTP URL that redirects. The disclosure appears alongside other recently published issues, including root-level OS command injection and authentication bypass flaws in Lantronix EDS5000/EDS3000PS devices (CVE-2025-67034 through CVE-2025-67041) and prototype pollution in Lodash 4.0.0–4.17.22 fixed in 4.17.23 (CVE-2025-13465).

Cloud Security · Amazon AWS Amplify CLI

AWS Amplify CLI Flaw (CVE-2024-28056) Could Expose IAM Roles to Unauthorized Assumption

Amazon AWS Amplify CLI versions before 12.10.1 incorrectly configure the role trust policy of IAM roles tied to Amplify projects: when the Authentication component is removed, a Condition property is dropped while "Effect":"Allow" remains, leaving sts:AssumeRoleWithWebIdentity available without conditions. Projects built between August 2019 and January 2024 from which an authorized AWS user removed the Authentication component could have allowed threat actors to assume the role and gain unauthorized access to AWS resources.

Security · VMware Reactor Netty

Reactor Netty HttpClient Can Leak Credentials on Cross-Domain Redirects (CVE-2020-5404)

CVE-2020-5404 affects Reactor Netty's HttpClient in versions 0.9.x before 0.9.5 and 0.8.x before 0.8.16, where credentials may be leaked during a redirect to a different domain, but only when the client is explicitly configured to follow redirects. The issue is part of a broader set of Reactor Netty advisories that also includes the HttpServer flaws CVE-2020-5403, CVE-2022-31684, CVE-2023-34062 (directory traversal) and CVE-2023-34054 (denial of service).

Security · VMware Spring Web Services

Spring Web Services Vulnerable to XML External Entity Injection (CVE-2019-3773)

Spring Web Services versions 2.4.3, 3.0.4, and older unsupported releases are susceptible to XML External Entity (XXE) injection when processing XML data from untrusted sources (CVE-2019-3773). Separately, Pivotal Reactor Netty versions prior to 0.8.11 pass headers, including authorization headers, through redirects, potentially exposing credentials to an unintended server (CVE-2019-11284).

Security · MOOS-IvP MOOS-IvP

MOOS-IvP through 24.8.1 Affected by Command Injection and Out-of-Bounds Read Flaws

MOOS-IvP versions through 24.8.1 contain a command injection vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir(), which fails to sanitize shell metacharacters in log file pathnames or the --dir parameter, allowing arbitrary command execution with the privileges of the operator running alogsplit. A separate out-of-bounds read affects the isQuoted(), isBraced(), and isChevroned() functions, which strip whitespace but index using the original string length, letting attackers send NODE_REPORT messages with leading or trailing whitespace to read adjacent memory.

Security · MOOS core-moos

MOOS core-moos Through 10.4.0 Lacks Authentication in MOOSDB Wire Protocol

MOOS core-moos versions through 10.4.0 contain no authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect using arbitrary client names to run privileged operations such as DB_CLEAR, which resets all variables and clears client mail queues.