Zevi

A Server-Side Request Forgery (SSRF) issue affects Apache Kylin, allowing an attacker with admin access to a kylin server to forge a request to invoke the "/kylin/api/xxx/diag" API endpoint on another internal host, potentially leaking information. This requires two preconditions: the attacker must have admin access to a kylin server, and another internal host must have the "/kylin/api/xxx/diag" API endpoint open for service.

A file read and write vulnerability exists in Apache DolphinScheduler, allowing authenticated users to illegally access additional resource files.