Stephen Lin

**Name of the Vulnerable Software and Affected Versions** caoqianming django-vue-admin version 1.0 **Description** Improper access controls exist in the `/api/file/` endpoint. A remote attacker can manipulate the `file id` argument to bypass security restrictions and gain unauthorized access to files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Doccano Open Source Annotation Tools for Machine Learning Practitioners versions prior to 1.8.6 **Description** Improper access controls exist within the Project Example Detail Endpoint. A remote attacker can exploit this issue via the `ExampleDetail()` function located at the '/v1/projects/1/examples/' endpoint, potentially leading to unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/v1/projects/1/examples/' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Doccano Open Source Annotation Tools for Machine Learning Practitioners versions prior to 1.8.6 **Description** Improper access controls exist within the Bulk-Delete Endpoint component. This issue affects the `LabelList()` function associated with the '/v1/projects/1/category-types' endpoint, allowing for remote exploitation through manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/v1/projects/1/category-types' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dibo-software diboot version 3.8.0 **Description** An authorization bypass exists in the AI Session Endpoint component. A remote attacker can manipulate an unknown functionality within the '/api/ai-session/' endpoint to bypass authorization requirements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/api/ai-session/' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** dibo-software diboot version 3.8.0 **Description** Improper access controls exist within the Tenant Administrator Management API component, specifically affecting functionality in the `/admin/` endpoint. A remote attacker can exploit this by manipulating the `tenantId` argument to gain unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dibo-software diboot version 3.8.0 **Description** Improper access controls exist within the Tenant Resource Assignment Handler component. A remote attacker can manipulate the `tenantId` argument at the '/api/iam/tenant/resource' endpoint to bypass security restrictions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `tenantId` parameter in the '/api/iam/tenant/resource' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** diaowen DWSurvey versions prior to 6.14.0 **Description** An improper authorization issue exists within the Survey Status Handler component. A remote attacker can exploit an unknown function in the '/api/dwsurvey/app/survey/up-survey-status.do' endpoint to bypass authorization controls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/api/dwsurvey/app/survey/up-survey-status.do' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** diaowen DWSurvey versions prior to 6.14.1 **Description** An authorization bypass exists in the Survey Handler component. A remote attacker can exploit this issue via the `DwDeisgnSurveyController.devSurvey()` function located at the '/api/dwsurvey/app/v6/dw-design-survey/dev-survey.do' endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/api/dwsurvey/app/v6/dw-design-survey/dev-survey.do' endpoint to minimize the risk of exploitation.