Ku4D3

**Name of the Vulnerable Software and Affected Versions** DTStack Taier version 1.4.0 **Description** A path traversal issue exists in the Chunk-Check Endpoint component within the `Paths.ge()` function of the `FileChunkController.java` file. A remote attacker can exploit this by manipulating the `Name` argument, allowing unauthorized access to files or directories outside the intended folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DTStack Taier version 1.4.0 **Description** A path traversal issue exists within the Cluster Creation component in the `ClusterController.java` file. The vulnerability occurs in the `FileUtils.deleteDirectory()` function when the `clusterName` argument is manipulated, allowing for remote exploitation. **Recommendations** Upgrade to version 1.5.0.

**Name of the Vulnerable Software and Affected Versions** Dromara lamp-cloud versions prior to 5.10.1 **Description** A path traversal issue exists in the File-Upload Controller component within the `FileAnyoneController.java` file. A remote attacker can exploit this by manipulating the `bucket` or `bizType` arguments, allowing them to access files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `FileAnyoneController.java` file or avoid using the `bucket` and `bizType` arguments in the File-Upload Controller until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Dromara lamp-cloud versions prior to 5.10.1 **Description** A path traversal issue exists in the Code Generator component within the `DefGenProjectController.java` file. A remote attacker can exploit this by manipulating the `outputDir`, `parent`, or `projectPrefix` arguments, allowing them to access or traverse directories outside the intended path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dromara lamp-cloud versions prior to 5.10.1 **Description** A path traversal issue exists in the `chunk-check` endpoint within the `FileChunkController.java` file. A remote attacker can manipulate the `Name` argument to perform path traversal, which allows accessing files or directories outside the intended folder. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Name` argument in the `chunk-check` endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** DTStack Taier version 1.4.0 **Description** A path traversal issue exists in the Upload Controller component within the `UploadController.java` file. The flaw occurs in the `MultipartFile.getOriginalFilename()` function when processing the `File` argument, which allows a remote attacker to manipulate file paths. **Recommendations** Upgrade to version 1.5.0.

**Name of the Vulnerable Software and Affected Versions** xianrendzw EasyReport versions prior to 2.0.17.0522 Beta **Description** A flaw in the REST Endpoint component allows for remote SQL injection, which is a technique where malicious SQL statements are inserted into entry fields for execution. The issue exists within the `execute()` function when the `reportParams` variable is manipulated. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dromara lamp-cloud versions prior to 5.6.3 **Description** Improper neutralization of special elements used in a template engine occurs within the Message Template Handler component. A remote attack is possible by manipulating the `DefMsgTemplate.content` argument, which affects the `GroovyClassLoader.parseClass()` function. **Recommendations** Update Dromara lamp-cloud to version 5.6.3 or later. As a temporary mitigation, restrict access to the `GroovyClassLoader.parseClass()` function within the Message Template Handler component.

**Name of the Vulnerable Software and Affected Versions** changmingxie tcc-transaction versions prior to 2.1.1 **Description** A remote deserialization issue exists within the Fastjson AutoType REST API component. The flaw is located in the `Fastjson.parseObject()` function, which allows an attacker to trigger deserialization remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.