Rockmelodeis

**Name of the Vulnerable Software and Affected Versions** deepseek-ai deepseek-harness versions prior to 0.1.0-rc.8 **Description** A remote attack can cause a sandbox issue within the Code Mode Sandbox component by manipulating the `run code()` function. The vendor has noted that the worker is intended for containment and is not designed to be a security boundary. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `run code()` function within the Code Mode Sandbox component.

**Name of the Vulnerable Software and Affected Versions** DeepSeek deepseek-harness versions prior to 0.1.7-rc.2 **Description** A path traversal flaw exists in the Bundle Patch Handler component. A remote attacker can manipulate the `dsh.bundle.patch` argument within the `loadProfile()` function located in the `packages/boot/app-boot/src/profile.ts` file. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized. **Recommendations** Update DeepSeek deepseek-harness to a version later than 0.1.7-rc.2. As a temporary workaround, restrict access to the `loadProfile()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** newbee-ltd newbee-mall versions prior to 1.0.1 **Description** A remote cross site scripting issue exists in the Goods Save Endpoint within the `controller/common/UploadController.java` file. By manipulating the `goodsName` argument, an attacker can bypass the image-only guard because `ImageIO.read()` is format-agnostic and returns non-null for polyglot PNG payloads. Combined with the `/upload/**` static mapping, this allows the upload of a payload that results in persisted cross site scripting. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PbootCMS versions prior to 3.2.23 **Description** A weakness in the Template Rendering component allows remote attackers to perform cross site scripting. The issue exists within the `decode string()` function located in the `apps/admin/controller/content/ContentController.php` file, where improper handling of the `Title` argument enables the attack. **Recommendations** Update PbootCMS to version 3.2.23 or later. As a temporary mitigation, restrict access to the `decode string()` function in the `apps/admin/controller/content/ContentController.php` file.

**Name of the Vulnerable Software and Affected Versions** PbootCMS versions prior to 3.2.25 **Description** A cross-site request forgery issue exists in the User Management component. A remote attacker can manipulate the `UserController::del()` and `UserController::mod()` functions within the `apps/admin/controller/system/UserController.php` file. **Recommendations** Upgrade to version 3.2.25.