Hans-Martin Münch

**Name of the Vulnerable Software and Affected Versions** ruby-mysql versions prior to 2.10.0 **Description** The issue allows a malicious MySQL server to request local file content from a client using ruby-mysql without explicit authorization from the user. A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. The server can create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide additional data from a local file readable by the client. **Recommendations** For versions prior to 2.10.0, update to version 2.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the LOAD DATA LOCAL statement until a patch is available. Avoid using the LOAD DATA LOCAL statement in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** ajaxpro.2 versions prior to 21.11.29.1 **Description** The issue is related to Deserialization of Untrusted Data, which can be abused to gain remote code execution. This occurs due to the possibility of deserialization of arbitrary .NET classes. An attacker can exploit this by sending a payload into the deserializer, resulting in the execution of commands. The vulnerability is attributed to the trust in Java Object Serialization, where developers may de-serialize objects pre-authentication, allowing an attacker to execute functions, including local OS commands, by combining the readObject() methods of various classes available on the classpath of the vulnerable application. **Recommendations** For versions prior to 21.11.29.1, update to the latest version from GitHub to address the issue. As a temporary workaround, consider restricting the deserialization of untrusted data to minimize the risk of exploitation. Avoid using any untrusted sources for downloading binary DLLs, especially from websites other than the official repository.

Name of the Vulnerable Software and Affected Versions: vis-timeline versions prior to 7.4.4 Description: The issue allows an attacker with the ability to control the items of a Timeline element to inject additional script code into the generated application. This can be done by exploiting the vulnerability in the vis-timeline package. Recommendations: For vis-timeline versions prior to 7.4.4, update to version 7.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Timeline element to minimize the risk of exploitation. Avoid using the vis-timeline package until the issue is resolved.