M4Ra7H0N

**Name of the Vulnerable Software and Affected Versions** Dromara SaToken versions 1.3.50RC and earlier **Description** An issue in Dromara SaToken when using Spring dynamic controllers may cause an authentication bypass due to a specially crafted request. **Recommendations** For Dromara SaToken versions 1.3.50RC and earlier, update to a version later than 1.3.50RC to resolve the issue. As a temporary workaround, consider restricting access to Spring dynamic controllers until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Dromara SaToken versions 1.36.0 and earlier IBM Sterling Connect Direct Web Services versions 6.0, 6.1.0, 6.2.0, 6.3.0 IBM Sterling Connect Direct Web Services (Certified Container) versions All **Description** An issue allows a remote attacker to escalate privileges via a crafted payload to the URL. **Recommendations** For Dromara SaToken versions 1.36.0 and earlier, update to a version later than 1.36.0. For IBM Sterling Connect Direct Web Services versions 6.0, 6.1.0, 6.2.0, 6.3.0, apply the recommended fix from IBM. For IBM Sterling Connect Direct Web Services (Certified Container) versions All, apply the recommended fix from IBM.