S1Ldyd

**Name of the Vulnerable Software and Affected Versions** JeecgBoot versions prior to 3.9.3 **Description** A server-side request forgery (SSRF) issue exists in the Anonymous Chat Attachment Parser component. A remote attacker can exploit this by manipulating an unknown function within the '/airag/chat/send' endpoint, allowing the server to make unauthorized requests to internal or external resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/airag/chat/send' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** jeequan jeepay versions prior to 3.2.10 **Description** An authorization bypass exists in the PreAuthorize Handler component. The issue resides in the `WebSecurityConfig()` function within the `jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java` file. This flaw allows a remote attacker to bypass authorization mechanisms. **Recommendations** As a temporary workaround, restrict access to the `WebSecurityConfig()` function in the `SysLogController.java` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.