Jiazhou

**Name of the Vulnerable Software and Affected Versions** ANTLR4 versions prior to 4.13.3 **Description** An issue exists in the Grammar Action Block Handler component within the file `tool/src/org/antlr/v4/codegen/model/OutputFile.java`. A remote attacker can perform a manipulation that leads to code injection, which allows the execution of arbitrary code on the target system. **Recommendations** Update to a version newer than 4.13.2.

**Name of the Vulnerable Software and Affected Versions** ANTLR4 versions prior to 4.13.3 **Description** Command injection is possible in the `gofmt` component via the `GoTarget()` function located in the `tool/src/org/antlr/v4/codegen/target/GoTarget.java` file. This issue allows an attacker to execute arbitrary commands, although the attack is limited to local environments. **Recommendations** Update to a version newer than 4.13.2. As a temporary mitigation, restrict access to the `GoTarget()` function within the `gofmt` component.

**Name of the Vulnerable Software and Affected Versions** ANTLR4 versions prior to 4.13.3 **Description** A time-of-check time-of-use (TOCTOU) flaw exists in the Maven Plugin component. This issue occurs within the `ObjectInputStream.readObject()` function located in the `antlr4-maven-plugin/src/main/java/org/antlr/mojo/antlr4/GrammarDependencies.java` file. TOCTOU is a race condition where a system checks the state of a resource before using it, but the state changes between the check and the use. Exploitation requires local execution and is characterized by high complexity and difficult exploitability. **Recommendations** Update to a version newer than 4.13.2. As a temporary mitigation, restrict local access to the Maven Plugin component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ANTLR4 versions prior to 4.13.3 **Description** An issue exists in the tokenVocab Grammar Option Handler where the `getImportedVocabFile()` function in the `tool/src/org/antlr/v4/parse/TokenVocabParser.java` file is susceptible to path traversal. This allows a remote attacker to manipulate file paths to access unauthorized locations. **Recommendations** Update to a version newer than 4.13.2. As a temporary mitigation, restrict the use of the `getImportedVocabFile()` function.

**Name of the Vulnerable Software and Affected Versions** SeriaWei ZKEACMS versions prior to 4.3 **Description** A security flaw has been discovered in the CheckPage/Suggestions function within the SEOSuggestions component of SeriaWei ZKEACMS. Manipulation of this function, located in the cms-v4.3wwwrootPluginsZKEACMS.SEOSuggestionsZKEACMS.SEOSuggestions.dll library, can lead to server-side request forgery (SSRF). This issue is remotely exploitable. The exploit is publicly available. **Recommendations** Update SeriaWei ZKEACMS to version 4.3 or later. As a temporary workaround, consider restricting access to the `CheckPage/Suggestions` function until a patch is available.