Hans-Martin Münch

**Name of the Vulnerable Software and Affected Versions** ruby-mysql versions prior to 2.10.0 **Description** The issue allows a malicious MySQL server to request local file content from a client using ruby-mysql without explicit authorization from the user. A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. The server can create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide additional data from a local file readable by the client. **Recommendations** For versions prior to 2.10.0, update to version 2.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the LOAD DATA LOCAL statement until a patch is available. Avoid using the LOAD DATA LOCAL statement in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ajaxpro.2 versions prior to 21.11.29.1 **Description** This issue involves the deserialization of untrusted data, which occurs when an application deserializes data without sufficient verification, allowing an attacker to control the execution flow or state. In this case, the software allows the deserialization of arbitrary .NET classes, which can be abused to achieve remote code execution. This flaw has been reported as actively exploited in real-world incidents. **Recommendations** Update ajaxpro.2 to version 21.11.29.1 or later.

Name of the Vulnerable Software and Affected Versions: vis-timeline versions prior to 7.4.4 Description: The issue allows an attacker with the ability to control the items of a Timeline element to inject additional script code into the generated application. This can be done by exploiting the vulnerability in the vis-timeline package. Recommendations: For vis-timeline versions prior to 7.4.4, update to version 7.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Timeline element to minimize the risk of exploitation. Avoid using the vis-timeline package until the issue is resolved.