Xiaobu

**Name of the Vulnerable Software and Affected Versions** jae-jae fetcher-mcp versions prior to 0.4.0 **Description** An issue exists in the URL Validation component where the `fetch url()` and `fetch urls()` functions in the `/latest/meta-data/iam/security-credentials/` file are susceptible to manipulation. This allows a remote attacker to perform server-side request forgery (SSRF), a technique where the attacker induces the server to make requests to an unintended location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the `fetch url()` and `fetch urls()` functions.

**Name of the Vulnerable Software and Affected Versions** saithink/saigroup SaiAdmin versions prior to 5.0.2 **Description** A flaw in the Plugin Upload Endpoint allows for unrestricted file upload. This issue occurs within the `shell exec()` function located in the `/app/saipackage/install/upload` file, enabling remote exploitation. **Recommendations** Update to a version newer than 5.0.1. As a temporary mitigation, restrict access to the `/app/saipackage/install/upload` file to prevent unauthorized uploads.