0Xlally

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.24 **Description** The `/de2api/share/proxyInfo` share interface generates and returns an `X-DE-LINK-TOKEN` before validating the share password or ticket. This allows unauthenticated attackers who possess a protected share UUID to obtain a valid link token, which can then be used for subsequent share-related API calls despite missing or invalid credentials. **Recommendations** Update to version 2.10.24.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.24 **Description** A share mode chart data interface fails to validate whether the `tableId` and field IDs provided in the request body belong to the shared resource. It only verifies that the `sceneId` matches the `resourceId` in the link token. This allows an attacker possessing a valid share link token to replace dataset identifiers and retrieve unauthorized data via the 'POST /de2api/chartData/getData' endpoint. **Recommendations** Update to version 2.10.24.

**Name of the Vulnerable Software and Affected Versions** CloakBrowser versions prior to 0.3.28 **Description** The `cloakserve` CDP multiplexer uses the user-supplied `fingerprint` query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker with network access to the `cloakserve` port can provide a crafted `fingerprint` value containing path traversal sequences to resolve `user data dir` outside the configured `data dir`. When Chrome fails to start or the process is cleaned up, the `shutil.rmtree()` function deletes the traversed path, leading to arbitrary directory deletion. By default, `cloakserve` is bound to `0.0.0.0`, which makes it exposed to the network. **Recommendations** Update to version 0.3.28. Restrict network access to the `cloakserve` port.