Hibrian827

**Name of the Vulnerable Software and Affected Versions** gitoxide versions prior to 0.38.2 **Description** The software fails to validate carriage return characters in URL values passed to credential helpers. This allows attackers to supply URLs containing bare carriage returns to inject additional helper protocol fields, potentially causing credential helpers to return credentials for attacker-specified hosts instead of the requested URL. **Recommendations** Update gitoxide to version 0.38.2 or later.

**Name of the Vulnerable Software and Affected Versions** jwcrypto (affected versions not specified) **Description** A flaw allows a remote attacker to cause a denial of service (DoS) by sending a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token forces the `JWE.deserialize()` function to allocate excessive memory, resulting in a `MemoryError` for services processing untrusted JWE values. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Socket.IO versions 4.1.0 through 6.6.6 **Description** The Engine.IO protocol v4 polling transport fails to properly close the HTTP response when receiving invalid binary POST requests that use the `Content-Type: application/octet-stream` header. This behavior allows an unauthenticated attacker to exhaust server-side connections and sockets, potentially leading to a denial of service. **Recommendations** Update to version 6.6.7.

**Name of the Vulnerable Software and Affected Versions** YARD versions prior to 0.9.44 **Description** YARD is a documentation generation tool for the Ruby programming language. The static cache lookup reads a request path before the router's path cleanup process occurs. When a server is configured with a document root, a traversal path such as '/../yard-cache-secret.html' can be joined against that root, allowing the return of a readable sibling `.html` file located outside the intended static tree. **Recommendations** Update to version 0.9.44.