Liuhuajin

**Name of the Vulnerable Software and Affected Versions** Apache Axis2/Java versions prior to 2.0.1 **Description** An issue exists in the Tribes-based clustering component when running on Apache Tomcat. When Tribes clustering is enabled, an unauthenticated remote attacker with network access to the clustering port can execute arbitrary code. This is achieved by sending a crafted serialized Java object to the cluster channel, which is then deserialized in the `messageReceived()` function of `org.apache.axis2.clustering.tribes.Axis2ChannelListener`. Deserialization is the process of converting a stream of bytes back into an object in memory. **Recommendations** Upgrade to version 2.0.1. As a temporary workaround, ensure that Tribes clustering remains disabled.

**Name of the Vulnerable Software and Affected Versions** Apache Kylin versions 4.0.0 through 5.0.2 **Description** A flaw exists in Apache Kylin that could allow external parties to access files or directories. Proper protection of Kylin's system and project admin access is crucial to prevent exploitation. **Recommendations** Upgrade to version 5.0.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Kylin versions 4.0.0 through 5.0.2 **Description** A Server-Side Request Forgery (SSRF) issue exists in Apache Kylin. The impact is limited if Kylin's system and project admin access is well protected. **Recommendations** Upgrade to version 5.0.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Kylin versions 4.0.0 through 5.0.2 **Description** An authentication bypass issue exists in Apache Kylin. This allows bypassing normal authentication mechanisms through an alternate path or channel. **Recommendations** Upgrade to version 5.0.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Seata (incubating) versions 2.0.0 through 2.1.x **Description** The issue is related to the deserialization of untrusted data, which can lead to remote code execution. This issue affects Apache Seata (incubating) from version 2.0.0 before 2.2.0. Users are recommended to upgrade to version 2.2.0 to fix the issue. **Recommendations** For Apache Seata (incubating) versions 2.0.0 through 2.1.x, upgrade to version 2.2.0 to resolve the issue.