Arpit Jain

**Name of the Vulnerable Software and Affected Versions** SmallRye GraphQL (affected versions not specified) **Description** An issue exists in the number scalar coercion for BigInteger that fails to properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This leads to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, which results in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** An issue exists where the template revision endpoint fails to enforce object-level authorization when retrieving an audited template revision. An authenticated user with low privileges and template-related permissions, such as `view ptables`, can access historical template contents from other organizations or locations by providing the relevant audit ID. This may lead to the unauthorized disclosure of sensitive data, including configuration details, credentials, or secrets. The REST API revision endpoints are not affected by this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 **Description** Spring MVC applications utilizing the functional web framework are susceptible to stream corruption when implementing Server-Sent Events (SSE), a mechanism that allows servers to push real-time updates to web pages over a single HTTP connection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists in the personal access token removal query where the system selects from `PersonalAccessTokenDB` but filters based on columns from `Session` without a proper join. SQLAlchemy interprets this as an implicit cross join, which fails to restrict the deletion process to the tokens belonging to the calling user. Consequently, an authenticated user can delete all personal access tokens across the entire system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The user detail view of the extension does not verify if the requested user record matches the configured or logged-in target. This allows visitors with access to the Detail or List plugin to retrieve profile data of other frontend users, such as name, email, date of birth, and address, by providing an arbitrary `user ID`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ash authentication versions 4.8.0 through 4.14.1 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.12 **Description** Reflected cross-site scripting (XSS) occurs when a strategy is configured with `require interaction?` set to true. The software serves intermediate HTML pages that embed request parameters directly into hidden input value attributes without HTML escaping. Specifically, the `confirm` parameter is interpolated in `lib/ash authentication/add ons/confirmation/confirmation form.html.eex` and the magic link token parameter is interpolated in `lib/ash authentication/strategies/magic link/sign in form.html.eex`. Because these templates use plain expressions that perform no escaping and the `accept/2` functions in `AshAuthentication.AddOn.Confirmation.Plug` and `AshAuthentication.Strategy.MagicLink.Plug` do not validate the values, an unauthenticated attacker can craft a URL to inject malicious markup. The injected script executes in the application origin, allowing access to cookies, sessions, and same-origin responses. **Recommendations** Update ash authentication to version 4.14.2 or later. Update ash authentication to version 5.0.0-rc.13 or later.

**Name of the Vulnerable Software and Affected Versions** Imager versions 0.45 02 through 1.033 **Description** An over-read occurs in the `copy string tags()` function when processing zero-count ASCII EXIF entries. The function calculates the tag length as `entry->size - 1`; if `entry->size` is 0, the resulting length of -1 is passed to `i tags add()`, which triggers a `strlen()` call. This causes the system to scan past the entry until the next NUL character is found, potentially exposing adjacent heap bytes. This path is reachable via `im decode exif()` when using JPEG images or the Imager::File::WEBP distribution. An attacker can exploit this by providing a specially crafted image to `Imager->read()`, causing the `exif *` tag to contain sensitive heap data instead of an empty string. **Recommendations** Update Imager to version 1.034 or later.

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions prior to 9.17-1.1 **Description** The Import/Export Data functionality fails to properly neutralize special elements, which allows a remote attacker to execute arbitrary operating system commands on the server. **Recommendations** Update to version 9.17-1.1.