H3H3Qaq

**Name of the Vulnerable Software and Affected Versions** Apache InLong versions 1.13.0 through 2.1.0 **Description** The issue is related to the deserialization of untrusted data in Apache InLong, which can lead to the bypass of JDBC URL encoding and backspace. This can potentially cause security problems. **Recommendations** For Apache InLong versions 1.13.0 through 2.1.0, update to version 2.2.0 to resolve the issue. Alternatively, cherry-pick the solution from the provided GitHub pull request to solve it.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.9 **Description** DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.9, authenticated users can complete Remote Code Execution (RCE) through the backend JDBC link. This issue has been patched in version 2.10.9. **Recommendations** For versions prior to 2.10.9, update to version 2.10.9 to resolve the issue. As a temporary workaround, consider restricting access to the backend JDBC link until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apache EventMesh versions prior to 1.11.0 **Description** The issue concerns the deserialization of untrusted data at the eventmesh-meta-raft plugin module in Apache EventMesh, allowing attackers to send controlled messages and execute remote code via the Hessian deserialization RPC protocol. This affects platforms such as Windows, Linux, and Mac OS. **Recommendations** For versions prior to 1.11.0, users can use the code under the master branch in the project repository or update to version 1.11.0 to fix this issue. As a temporary workaround, consider restricting access to the vulnerable `eventmesh-meta-raft` plugin module until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Apache InLong versions 1.13.0 through 2.1.0 **Description** The issue affects Apache InLong, allowing attackers to bypass its security mechanisms and enabling arbitrary file reading due to a deserialization of untrusted data vulnerability. **Recommendations** For Apache InLong versions 1.13.0 through 2.1.0, update to version 2.2.0 to resolve the issue. Alternatively, users can cherry-pick the solution from the provided GitHub pull request.