Dptcc

An issue exists in the flow-run component within the file `org/jeecg/modules/airag/flow/c/a.class` that allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This is caused by the `RestTemplate.exchange()` function.

An issue in the Authentication Filter component allows for remote server-side request forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. This occurs within the `OpenApiController.call` function at the '/openapi/call' endpoint.

A flaw exists in Bjskzy Zhiyou ERP that allows for xml external entity reference manipulation. This issue is present in the `initRCForm` function within the `RichClientService.class` file of the `com.artery.richclient.RichClientService` component. The attack can be carried out remotely. The exploit is publicly available. The vendor was notified but did not respond.