Galaxynx

**Name of the Vulnerable Software and Affected Versions** django-blog-zinnia versions prior to 0.21 **Description** A security flaw in the Protected Entry Password Handler component, specifically within the `zinnia/views/mixins/entry protection.py` file, leads to the cleartext storage of sensitive information. This issue requires local access to be exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** django-jet versions prior to 1.0.9 **Description** An authorization bypass exists in the Dashboard Module within the file `jet/dashboard/views.py`. This flaw allows a remote attacker to bypass authorization mechanisms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** django-jet versions prior to 1.0.9 **Description** A missing authorization flaw exists in the OAuth Credential Revoke Handler component. This issue allows a remote attacker to perform a manipulation that bypasses authorization requirements. **Recommendations** Update to a version newer than 1.0.8. Restrict access to the OAuth Credential Revoke Handler component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** django-jet versions prior to 1.0.9 **Description** A weakness in the OAuth Handler component allows a remote attacker to perform a cross-site request forgery (CSRF), which is an attack that forces an authenticated user to execute unwanted actions on a web application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** guohongze adminset versions prior to 0.62 **Description** An authorization bypass exists in the Delivery Deployment Endpoint within the `delivery/deli.py` file. A remote attacker can bypass authorization by manipulating the `project id` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the `project id` argument in the `delivery/deli.py` file to minimize the risk of exploitation.

A vulnerability was detected in hunvreus devpush up to 0.4.6. Affected by this issue is the function reset storage of the file app/workers/tasks/storage.py of the component Storage Reset Failure Handler. The manipulation results in improper check or handling of exceptional conditions. A high complexity level is associated with this attack. The exploitation is known to be difficult. The project was informed of the problem early through an issue report but has not responded yet.