Yyjlf

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.3.3 through 1.3.4 Apache IoTDB versions 2.0.1-beta through 2.0.4 **Description** A security issue exists in Apache IoTDB. Upgrade to version 2.0.5 to resolve the problem. **Recommendations** Upgrade to version 2.0.5.

Name of the Vulnerable Software and Affected Versions: Apache Commons OGNL (affected versions not specified) Description: An improper neutralization of expression/command delimiters issue exists in Apache Commons OGNL. The OGNL engine, when used with the `Ognl.getValue` API, parses and evaluates expressions, offering capabilities like method access and invocation. Existing restrictions attempting to block dangerous classes and methods are not comprehensive, potentially allowing attackers to bypass them using uncovered class objects and achieve arbitrary code execution. Recommendations: As this project is retired and no fix is planned, users are recommended to find an alternative or restrict access to the instance to trusted users.

Name of the Vulnerable Software and Affected Versions: MPXJ versions prior to 13.5.1 Description: The patch for a historical issue in MPXJ is incomplete, allowing a malicious path to be constructed that could enable files to be written to arbitrary locations. Recommendations: For versions prior to 13.5.1, update to version 13.5.1 to address the issue. As a temporary workaround, do not pass zip files to MPXJ until the issue is resolved.