Michael Scovetta

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** In the `extract()` function of the Tarfile module, the `filter` parameter is not correctly handled when extracting hardlinks. This issue allows a system extracting content from untrusted tar files to write files with an unexpected uid/gid, even when the user has specified `filter='data'` to restrict the extraction process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebCalendar version 0.9.45 **Description** A SQL injection issue exists in the user valid crypt function in user.php, allowing remote attackers to execute arbitrary SQL commands via an encoded webcalendar session cookie. **Recommendations** For WebCalendar version 0.9.45, consider disabling the user valid crypt function in user.php as a temporary workaround until a patch is available. Restrict access to the user.php module to minimize the risk of exploitation. Avoid using the webcalendar session cookie in the affected API endpoint until the issue is resolved.