A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally, it can be used to make outbound network requests, resulting in server-side request forgery.

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.

A flaw was found in JWCrypto, a Python library for JSON Web Key (JWK), JSON Web Signature (JWS), and JSON Web Encryption (JWE) specifications. An unauthenticated attacker can exploit this vulnerability by sending specially crafted JWE tokens that use ZIP compression. While the input token size is limited, the decompressed output size is not validated, allowing an attacker to cause excessive memory consumption. This can lead to memory exhaustion on affected systems, resulting in a Denial of Service (DoS).

A flaw was found in daphne. An unauthenticated remote attacker could exploit this vulnerability by sending arbitrarily large WebSocket messages or frames. This oversight in payload size handling can lead to excessive memory consumption, resulting in a denial of service (DoS) for the affected system.

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the designated temporary directory. This could lead to unauthorized file creation at attacker-controlled locations with the privileges of the running process.

A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction.

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).

A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clone_from() method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to exfiltrate sensitive environment variables, such as access keys or tokens, to an attacker-controlled server during the cloning process, leading to information disclosure.

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive() and git.ls_remote(), potentially leading to arbitrary code execution. Additionally, functions such as Repo.iter_commits() and Repo.blame() do not validate revision arguments, which could allow an attacker to truncate arbitrary files. Exploitation requires an application to pass attacker-controlled input directly to these vulnerable methods.

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms (e.g., -u<value>) when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a Git clone operation. This can lead to a complete compromise of the affected system.

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous options. This allows for the execution of arbitrary commands, leading to potential arbitrary code execution.

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before the entire body is received. This leaves trailing data to be processed incorrectly, potentially enabling an attacker to bypass security mechanisms or gain unauthorized access to resources.