Mydosgyarados

Uncontrolled resource consumption occurs when parsing a small YAML OpenAPI document containing nested anchors and aliases through public YAML reader APIs. While the initial parsing via SharpYaml uses a directed acyclic graph to keep the structure small, the conversion to `System.Text.Json.Nodes.JsonNode` requires every alias to be materialized as an independent node. Because there is no bound on this conversion, a document with N nested anchors referenced k times can result in k^N materialized JSON nodes. This leads to excessive memory allocation and process termination due to out-of-memory conditions, creating a billion laughs style denial of service (a type of attack where a small input expands exponentially to consume all available system memory).

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.12 Description: A SQL Injection vulnerability was discovered in the WeGIA application, `deletar permissao.php` endpoint. This issue could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. Recommendations: For versions prior to 3.2.12, update to version 3.2.12 to resolve the issue. As a temporary workaround, consider restricting access to the `deletar permissao.php` endpoint until the update is applied.