R1Ckyz

Remote code injection is possible via the JSP File Handler component. The `update()` function within the file `org/codelibs/fess/app/web/admin/design/AdminDesignAction.java` fails to properly handle the `content` argument, allowing a remote attacker to inject malicious code.

Ladybug is a tool that adds message-based debugging, unit, system, and regression testing to Java applications. The software contains the API endpoints `/iaf/ladybug/api/report/{storage}` and `/iaf/ladybug/api/report/upload`, which permit the upload of gzip-compressed XML files with user-controllable content. The system deserializes these XML files, potentially allowing an attacker to achieve Remote Code Execution (RCE) by submitting specially crafted XML payloads and gaining access to the target server. The vulnerable parameters are the content of the uploaded XML files.

A flaw exists in the lsfusion platform that allows for path traversal. This issue affects the `UploadFileRequestHandler` function located in the file `platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java`. Manipulation of the `sid` argument can lead to unauthorized access. The attack can be carried out remotely, and the exploit is publicly available.

A flaw exists in the lsfusion platform that allows for path traversal. This issue is related to the `unpackFile` function located in the file server/src/main/java/lsfusion/server/physics/dev/integration/external/to/file/ZipUtils.java. The manipulation of this function can lead to unauthorized access. This attack can be initiated remotely.

A flaw exists in Dromara dataCompare related to the JDBC URL Handler component. The issue resides within the `DbConfig` function of the file `src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java`. Manipulation of this function can lead to injection, and the attack can be launched remotely. An exploit for this issue has been published.

A security issue exists in wwwlike vlife that allows for path traversal. The issue is located in the `create` function within the `vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java` file of the `VLifeApi` component. Manipulation of the `fileName` argument enables remote exploitation. The exploit for this issue has been publicly disclosed.

A flaw exists in the lsfusion platform that allows for path traversal. This issue affects the `DownloadFileRequestHandler` function located in the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Manipulation of the `Version` argument can lead to exploitation. The exploit has been publicly disclosed.

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. The issue is related to the mechanism of deserialization in the Apache Dubbo RPC framework, allowing a remote attacker to execute arbitrary code.