EUVD-2022-5476

Malicious code in bioql PyPI...

com.bstek.ureport:ureport2-console (>=2.0.0, <=2.2.9), com.bstek.ureport:ureport2-font (>=2.0.0, <=2.0.1) +13 more potentially affected by CVE-2023-24187 via com.bstek.ureport:ureport2-core (>=2.0.0, <=2.2.9)

com.bstek.ureport:ureport2-core MAVEN version =2.0.0, =2.0.0, =2.0.0, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.0.0-beta, =1.5.1, =1.5.1, =0.0.1, =1.1.0, =3.0.4-release, =2.0, =2.8.0, =4.2.0, =5.0.2 Source cves: CVE-2023-24187 Source advisory: OSV:GHSA-FHJ6-GR87-G4CJ...

CVE-2022-25767

CVE-2022-25767 affects all versions of the Java package com.bstek.ureport:ureport2-console. The vulnerability enables Remote Code Execution via deserialization when the system connects to a malicious database server, leading to arbitrary file reads and deserialization of local gadgets. Multiple s...