Saravana Kumar

**Name of the Vulnerable Software and Affected Versions** Django versions 4.2 through 4.2.17 Django versions 5.0 through 5.0.10 Django versions 5.1 through 5.1.4 **Description** A potential denial-of-service attack could occur due to the lack of upper-bound limit enforcement in strings passed when performing IPv6 validation. The undocumented and private functions `clean ipv6 address` and `is valid ipv6 address` are vulnerable, as is the `django.forms.GenericIPAddressField` form field. **Recommendations** For Django versions 4.2 through 4.2.17, update to version 4.2.18 or later. For Django versions 5.0 through 5.0.10, update to version 5.0.11 or later. For Django versions 5.1 through 5.1.4, update to version 5.1.5 or later.

**Name of the Vulnerable Software and Affected Versions:** Apache Tomcat versions 11.0.0-M1 through 11.0.8 Apache Tomcat versions 10.1.0-M1 through 10.1.42 Apache Tomcat versions 9.0.0.M1 through 9.0.106 **Description:** An integer overflow issue in Apache Tomcat, under specific multipart upload configurations, may allow a denial-of-service (DoS) attack by bypassing size limits. **Recommendations:** Upgrade to Apache Tomcat version 11.0.9. Upgrade to Apache Tomcat version 10.1.43. Upgrade to Apache Tomcat version 9.0.107.

Name of the Vulnerable Software and Affected Versions: TCPDF version 6.7.5 Description: A Local File Inclusion (LFI) issue has been discovered, allowing a user to read arbitrary files from the server's file system through the `src` tag in an `img` element, potentially exposing sensitive information. Recommendations: For TCPDF version 6.7.5, consider disabling the `img` tag or restricting the `src` attribute to prevent exploitation until a patch is available. Restrict access to sensitive files on the server to minimize the risk of information exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.