Cyanm0Un

**Name of the Vulnerable Software and Affected Versions** jeecgboot jeewx-boot versions up to 641ab52c3e1845fec39996d7794c33fb40dad1dd **Description** A remote unrestricted upload issue exists in the `doUpload` endpoint. The problem resides in the `MyJwWebJwid3Controller.doUpload()` function within the `jeewx-boot-module-weixin/src/main/java/com/jeecg/p3/open/web/back/MyJwWebJwid3Controller.java` file. By manipulating the `File` argument, an attacker can upload files without proper restrictions. **Recommendations** As a temporary workaround, restrict access to the `doUpload` endpoint or avoid using the `File` argument in the `MyJwWebJwid3Controller.doUpload()` function until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerJob versions prior to 5.1.3 **Description** A server-side request forgery (SSRF) issue exists in the Transport Endpoint component. This occurs within the `MuConnectionManager.getOrCreateConnection()` function located in the `powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java` file. A remote attacker can manipulate this function to induce the server to make unauthorized requests. **Recommendations** As a temporary workaround, restrict access to the `MuConnectionManager.getOrCreateConnection()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.