X1R0Z

A remote code execution issue exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Hessian is a binary object serialization format.

The issue concerns the deserialization of untrusted data at the eventmesh-meta-raft plugin module in Apache EventMesh, allowing attackers to send controlled messages and execute remote code via the Hessian deserialization RPC protocol. This affects platforms such as Windows, Linux, and Mac OS.

The issue is related to the deserialization of untrusted data in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private protocol. This can allow a remote attacker to cause a denial of service using a specially crafted request.

The issue affects Apache InLong due to improper control of code generation, which could lead to remote code execution. This allows a remote attacker to execute arbitrary code. Users are advised to take immediate action to mitigate the threat.

The issue is related to the deserialization of untrusted data in Apache InLong, allowing attackers to perform an arbitrary file read attack using the mysql driver.

The issue is related to an Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong, which could lead to Remote Code Execution. This vulnerability affects Apache InLong versions from 1.5.0 through 1.9.0.

The issue is related to insufficient input validation in the Core component of Oracle WebLogic Server, part of the Oracle Fusion Middleware platform. This can be exploited by a remote attacker to gain unauthorized access to protected information. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

The issue is related to errors in handling input data in the Core component of the Oracle WebLogic Server. It allows an unauthenticated attacker with network access via T3 to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the Oracle WebLogic Server.