Cafe-Tea

**Nome do Software Vulnerável e Versões Afetadas** nbcio-boot versão 1.0.3 **Descrição** nbcio-boot versão 1.0.3 contém uma vulnerabilidade de injeção de SQL através do parâmetro `userIds` no endpoint da API `/sys/user/deleteRecycleBin`. **Recomendações** nbcio-boot versão 1.0.3: Sanitizar ou validar o parâmetro `userIds` antes de usá-lo em consultas SQL para prevenir ataques de injeção. nbcio-boot versão 1.0.3: Implementar consultas parametrizadas ou prepared statements para garantir que a entrada fornecida pelo usuário seja tratada como dados em vez de código executável. nbcio-boot versão 1.0.3: Como solução temporária, restringir o acesso ao endpoint da API `/sys/user/deleteRecycleBin` até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** erupt version 1.12.19 **Description** The issue is related to an arbitrary file upload vulnerability in the /upload/GoodsCategory/image component, which allows attackers to execute arbitrary code by uploading a crafted file. **Recommendations** For erupt version 1.12.19, consider disabling the /upload/GoodsCategory/image component until a patch is available to prevent arbitrary file uploads and subsequent code execution. Restrict access to this component to minimize the risk of exploitation. Avoid using this component for file uploads until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** JEHC-BPM version 2.0.1 **Description** The issue allows attackers to execute arbitrary code via uploading a crafted file to the "/server/executeExec" API endpoint. This is due to an arbitrary file upload vulnerability in the component. **Recommendations** For JEHC-BPM version 2.0.1, consider restricting access to the `/server/executeExec` API endpoint to minimize the risk of exploitation until a patch is available. Avoid using this endpoint with untrusted input to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.