Taichi Kotake

**Name of the Vulnerable Software and Affected Versions** Remarshal versions prior to 0.17.1 **Description** The issue allows for the expansion of YAML alias nodes unlimitedly, making Remarshal susceptible to a Billion Laughs Attack. This can lead to a denial-of-service (DoS) condition when processing untrusted YAML files. **Recommendations** For versions prior to 0.17.1, update to version 0.17.1 or later to resolve the issue. As a temporary workaround, consider avoiding the processing of untrusted YAML files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** untangle versions 1.2.0 and earlier **Description** untangle is a python library to convert XML data to python objects. It improperly restricts XML external entity references, allowing a remote unauthenticated attacker to read the contents of local files by exploiting this issue. **Recommendations** For versions 1.2.0 and earlier, update to version 1.2.1 to resolve the issue. As a temporary workaround, consider restricting XML external entity references to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** untangle versions 1.2.0 and earlier **Description** The issue is related to the improper restriction of recursive entity references in DTDs, which can be exploited by a remote unauthenticated attacker to cause a denial-of-service (DoS) condition on the server where the product is running. **Recommendations** For versions 1.2.0 and earlier, update to version 1.2.1 to resolve the issue. At the moment, there is no other information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Mercari (Japan version) versions prior to 3.52.0 **Description** The issue allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack. This is achieved by using Java Reflection API of JavaScript code on WebView. **Recommendations** For versions prior to 3.52.0, update to version 3.52.0 or later to resolve the issue.