Fakebug

A remote deserialization issue exists within the xxl-rpc Listener component, specifically in the `Hessian2Input.readObject()` function located in the `/serialize/impl/HessianSerializer.java` file. Deserialization occurs when untrusted data is processed, potentially allowing a remote attacker to execute unauthorized actions.

A path traversal flaw exists in the `logDetailCat` endpoint. The issue resides in the `FileInputStream()` function within the `/admin/controller/JobLogController.java` file. A remote attacker can exploit this by manipulating the `executorAddress` argument to access files outside the intended directory.

A path traversal issue exists in the Snapshot Endpoint component within the `PlayController.java` file. A remote attacker can exploit this by manipulating the `deviceId` or `channelId` arguments, allowing unauthorized access to files or directories on the system.

A path traversal flaw exists in the Log File Download Endpoint within the `LogController.java` file. A remote attacker can manipulate the `fileName` argument to access files outside the intended directory. Path traversal is a technique that allows an attacker to read arbitrary files on the server by using special characters like dot-dot-slash (../) to navigate the file system.

An OS command injection issue exists in the REST API component. Remote attackers can exploit this by manipulating the `sqlText` argument passed to the `Runtime.exec()` function.

An issue in the Admin API Endpoint component allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the manipulation of the `IotDataSinkHttpConfig` function within the '/admin-api/iot/data-sink/create' endpoint. The attack can be executed remotely.

A security flaw exists in FlowCI flow-core-x. The issue resides in the `Save` function within the `core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java` file of the SMTP Host Handler component. This manipulation can lead to server-side request forgery, and the attack can be initiated remotely. The exploit is publicly available. The vendor was notified but did not respond.