Lxf

**Name of the Vulnerable Software and Affected Versions** aiyiyi121 SxDevOps versions 1.0 through 1.1 **Description** A command injection flaw exists in the MCP STDIO Server Management component within the `subprocess.Popen()` function of the `backend/aiops/services.py` file. A remote attacker can exploit this by manipulating the `endpoint or command` argument to execute arbitrary commands. **Recommendations** Deploy patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1.

**Name of the Vulnerable Software and Affected Versions** aiyiyi121 SxDevOps versions 1.0 through 1.1 **Description** Remote command injection is possible within the TASK RUN COMMAND component. The issue exists in the `paramiko.SSHClient.exec command()` function located in the `backend/ops/host tasks.py` file, where improper handling of the `command` variable allows an attacker to execute arbitrary commands. **Recommendations** Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1.

**Name of the Vulnerable Software and Affected Versions** aiyiyi121 SxDevOps versions 1.0 through 1.1 **Description** A command injection issue exists within the Command Handler component. The `generate host task()` function in the `backend/aiops/services.py` file fails to properly handle the `command` argument, allowing remote attackers to execute arbitrary commands. **Recommendations** Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1. As a temporary mitigation, restrict access to the `generate host task()` function.

**Name of the Vulnerable Software and Affected Versions** aiyiyi121 SxDevOps versions 1.0 through 1.1 **Description** An issue exists in the `UserSerializer` component within the `backend/rbac/serializers.py` file. A remote attacker can manipulate the `update()` function to cause improper privilege management. **Recommendations** Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1. As a temporary mitigation, restrict access to the `update()` function in the `UserSerializer` component.

**Name of the Vulnerable Software and Affected Versions** aiyiyi121 SxDevOps versions 1.0 through 1.1 **Description** A remote attack is possible due to the use of hard-coded credentials within the `ensure default superuser()` function located in the `rbac/services.py` file. **Recommendations** Apply the patch with identifier 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1.

**Name of the Vulnerable Software and Affected Versions** aiyiyi121 SxDevOps versions 1.0 through 1.1 **Description** A security flaw in the Settings Handler component involves improper processing of the `backend/sxdevops/settings.py` file. This issue allows a remote attacker to exploit hard-coded credentials. **Recommendations** Apply patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1.

**Name of the Vulnerable Software and Affected Versions** aiyiyi121 SxDevOps versions 1.0 through 1.1 **Description** A weakness in the file `backend/sxdevops/settings.py` allows for remote information disclosure. **Recommendations** Install patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9 for versions 1.0 through 1.1.