Le1A

**Name of the Vulnerable Software and Affected Versions** Apache Linkis versions 1.0.0 through 1.7.0 **Description** A flaw exists where the `decode()` function within org.apache.linkis.metadata.util.HiveUtils does not properly handle Base64 decoding failures. When decoding fails, the complete input parameter, which may contain sensitive information like Hive Metastore keys or plaintext passwords, is logged at the error level. This can lead to information leakage if log files are accessible to unauthorized users. The probability of Base64 decoding failure is low, and the leakage is only triggered when error-level logs are exposed. **Recommendations** Upgrade to Apache Linkis version 1.8.0 or later, which replaces the logging of the input parameter with desensitized content.

**Name of the Vulnerable Software and Affected Versions** Apache Linkis versions 1.3.0 through 1.7.0 **Description** A flaw exists in Apache Linkis when utilizing the JDBC engine and data source functionality. Multiple rounds of URL encoding applied to the URL parameter configured on the frontend can circumvent system checks. This bypass may enable unauthorized access to system files through JDBC parameters. The issue is related to insufficient validation of connection information, specifically regarding the presence of the '%' character. **Recommendations** Upgrade to version 1.8.0, which addresses this issue. Continuously check if the connection information contains the "%" character and perform URL decoding if it does.

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.12 Description: DataEase is an open source business intelligence and data visualization tool. Due to insufficient filtering of DB2 parameters, a JNDI injection attack can be launched, triggering an AspectJWeaver deserialization attack that results in writing to various files. This vulnerability requires commons-collections 4.x and aspectjweaver-1.9.22.jar. Recommendations: Update DataEase to version 2.10.12 or later.

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11 Description: DataEase is an open source business intelligence and data visualization tool. There is a bypass vulnerability in DataEase's Redshift Data Source JDBC Connection Parameters. The `sslfactory` and `sslfactoryarg` parameters could trigger a bypass vulnerability. This issue has been patched in version 2.10.11. Recommendations: For versions prior to 2.10.11, update to version 2.10.11 to resolve the issue. As a temporary workaround, consider restricting the use of the `sslfactory` and `sslfactoryarg` parameters in the Redshift Data Source JDBC Connection Parameters until the update is applied.

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.11 Description: DataEase is an open source business intelligence and data visualization tool. There is a bypass vulnerability in DataEase's PostgreSQL Data Source JDBC Connection Parameters. The `sslfactory` and `sslfactoryarg` parameters could trigger a bypass vulnerability. This issue has been patched in version 2.10.11. Recommendations: For versions prior to 2.10.11, update to version 2.10.11 to resolve the issue. As a temporary workaround, consider restricting the use of the `sslfactory` and `sslfactoryarg` parameters in the PostgreSQL Data Source JDBC Connection Parameters until the update is applied.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.10 **Description** The issue concerns ineffective secret verification in DataEase, allowing a user to forge a JWT token using any secret. This could potentially lead to unauthorized access. The problem has been fixed in version 2.10.10. **Recommendations** For versions prior to 2.10.10, update to version 2.10.10 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application that rely on secret verification until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.10 **Description** A bypass of the patch for a previous issue exists, allowing for the construction of a malicious JDBC statement. In a malicious payload, the `getUrlType()` function retrieves the `hostName`. Since the judgment statement returns false, it will not enter the if statement and will not be filtered. This allows the payload to be directly concatenated at the replace location. **Recommendations** For versions prior to 2.10.10, update to version 2.10.10 to resolve the issue. As a temporary workaround, consider restricting the use of the `getUrlType()` function until the patch is applied. Avoid using the `hostName` variable in the affected JDBC statement until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Apache Linkis versions prior to 1.7.0 Description: In Apache Linkis, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the `DataSource Manager Module` will allow the attacker to read arbitrary files from the Linkis server. The parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Recommendations: For Apache Linkis versions prior to 1.7.0, we recommend upgrading the version of Linkis to version 1.7.0. As a temporary workaround, consider blacklisting the parameters in the Mysql JDBC URL to minimize the risk of exploitation. Restrict access to the `DataSource Manager Module` to minimize the risk of exploitation. Avoid using malicious Mysql JDBC parameters in the `DataSource Manager Module` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ujcms version 6.0.2 **Description** The issue concerns a file upload vulnerability. It is exploited via the "/api/backend/core/web-file-upload/upload" API endpoint. **Recommendations** For ujcms version 6.0.2, consider restricting access to the "/api/backend/core/web-file-upload/upload" API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tenda AX1803 version 1.0.0.1 2890 **Description** The issue is related to a Buffer Overflow that can cause a denial of service in the router. It is located in the `/goform/setsystimecfg` endpoint of the `/bin/tdhttpd` in the ubif file system. Attackers can access the endpoint via `http://ip/goform/SetSysTimeCfg` and exploit the `ntpserve` parameter to trigger a stack buffer overflow. **Recommendations** For Tenda AX1803 version 1.0.0.1 2890, as a temporary workaround, consider restricting access to the `/goform/setsystimecfg` endpoint until a patch is available. Avoid using the `ntpserve` parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.