Leon

**Name of the Vulnerable Software and Affected Versions** Apache APISIX versions 2.14.1 through 3.16.0 **Description** An incorrect authorization issue exists in the `authz-casdoor` plugin when using the default configuration. This allows an attacker to authenticate using credentials from a different source. **Recommendations** Upgrade to version 3.17.0.

**Name of the Vulnerable Software and Affected Versions** Apache APISIX versions 3.11.0 through 3.16.0 **Description** An authentication bypass exists due to a capture-replay issue. An attacker can leverage specific configurations in the `hmac-auth` module to reuse a token indefinitely, effectively bypassing the token expiry mechanism. **Recommendations** Upgrade to version 3.17.0.

**Name of the Vulnerable Software and Affected Versions** FreeXL versions prior to 1.0.5 **Description** A problem has been discovered in FreeXL, where there is a heap-based buffer over-read in a memcpy call of the `parse SST` function. This issue affects versions prior to 1.0.5. **Recommendations** For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `parse SST` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeXL versions prior to 1.0.5 **Description** A problem has been discovered in FreeXL, where there is a heap-based buffer over-read in the `freexl::destroy cell` function. This issue affects versions prior to 1.0.5. **Recommendations** For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `freexl::destroy cell` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeXL versions prior to 1.0.5 **Description** An issue was discovered in FreeXL, where there is a heap-based buffer over-read in the `read mini biff next record` function. This issue affects versions prior to 1.0.5. **Recommendations** For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `read mini biff next record` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeXL versions prior to 1.0.5 **Description** A problem has been discovered in FreeXL, where there is a heap-based buffer over-read in the `parse unicode string` function. This issue affects versions prior to 1.0.5. **Recommendations** For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `parse unicode string` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FreeXL versions prior to 1.0.5 **Description** A problem has been discovered in FreeXL, where there is a heap-based buffer over-read in a pointer dereference of the `parse SST` function. This issue affects versions prior to 1.0.5. **Recommendations** For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `parse SST` function until a patch is available.