Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked

Requests to cache an image could be abused to include SQL queries that would be executed unchecked

Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked

Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization

RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer

The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups

The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service

Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements