In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In rwmfchandlereadop of rwmfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

Inadequate permission checks exposed unauthorized RSS feeds to users.

Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7, 4.3 to 4.3.11, 4.1 to 4.1.17 and earlier unsupported versions Versions fixed: 4.5.4, 4.4.8, 4.3.12 and 4.1.18

Description of the problem: The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack. Clickjacking, also known as a 'UI redress attack', is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is 'hijacking' clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both.

Release version: 2.4.4

Operator snapshot version: Unknown

OCP version: 4.9

Browser Info: Unknown

Steps to reproduce: 1. Login into the application Using "admin1" user 2. Navigate to search >> filter 3. Intercept the request using a proxy tool 4. Apply attack value in parameter Parameter: filters Attack Value: [{"property":"kind","values":["test"]},{"property":"'b) OR (1","values":["1'"]}

Actual results:

Expected results:

Additional info: