deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-8234
Published: 2025-07-27
Description: A vulnerability was found in code-projects Online Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_member.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/5; https://vuldb.com/?ctiid.317822
CVE: CVE-2025-8235
Published: 2025-07-27
Description: A vulnerability was found in code-projects Online Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/product.php. The manipulation of the argument Name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/4; https://vuldb.com/?ctiid.317823
CVE: CVE-2025-8236
Published: 2025-07-27
Description: A vulnerability was found in code-projects Online Ordering System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/edit_product.php. The manipulation of the argument Name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/3; https://vuldb.com/?ctiid.317824
CVE: CVE-2025-8237
Published: 2025-07-27
Description: A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/update_s1.php. The manipulation of the argument credits leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/10; https://vuldb.com/?ctiid.317825
CVE: CVE-2025-8238
Published: 2025-07-27
Description: A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s2.php. The manipulation of the argument credits leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/11; https://vuldb.com/?ctiid.317826
CVE: CVE-2025-8239
Published: 2025-07-27
Description: A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/9; https://vuldb.com/?ctiid.317827
CVE: CVE-2024-58261
Published: 2025-07-27
Description: The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.
CVSS Score: 2.9 (LOW)
CWE: CWE-835
References: https://crates.io/crates/sequoia-openpgp; https://gitlab.com/sequoia-pgp/sequoia/-/issues/1106; https://rustsec.org/advisories/RUSTSEC-2024-0345.html
CVE: CVE-2024-58262
Published: 2025-07-27
Description: The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.
CVSS Score: 2.9 (LOW)
CWE: CWE-733
References: https://crates.io/crates/curve25519-dalek; https://github.com/dalek-cryptography/curve25519-dalek/pull/659; https://rustsec.org/advisories/RUSTSEC-2024-0344.html
CVE: CVE-2024-58263
Published: 2025-07-27
Description: The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.
CVSS Score: 3.7 (LOW)
CWE: CWE-190
References: https://crates.io/crates/cosmwasm-std; https://github.com/CosmWasm/advisories/blob/main/CWAs/CWA-2024-002.md; https://rustsec.org/advisories/RUSTSEC-2024-0338.html
CVE: CVE-2025-8240
Published: 2025-07-27
Description: A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /user/dashboard.php. The manipulation of the argument phone leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/8; https://vuldb.com/?ctiid.317828
CVE: CVE-2023-53156
Published: 2025-07-27
Description: The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-190
References: https://crates.io/crates/transpose; https://github.com/advisories/GHSA-5gmm-6m36-r7jh; https://github.com/ejmahler/transpose/issues/11
CVE: CVE-2024-58264
Published: 2025-07-27
Description: The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.
CVSS Score: 3.2 (LOW)
CWE: CWE-674, CWE-787
References: https://crates.io/crates/serde-json-wasm; https://github.com/advisories/GHSA-rr69-rxr6-8qwf; https://rustsec.org/advisories/RUSTSEC-2024-0012.html
CVE: CVE-2025-8241
Published: 2025-07-27
Description: A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. This affects an unknown part of the file /report.php. The manipulation of the argument From leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/online-Y/CVE/issues/1; https://vuldb.com/?ctiid.317829
CVE: CVE-2025-8242
Published: 2025-07-27
Description: A vulnerability has been found in TOTOLINK X15 1.0.0-B20[PII_REDACTED] and classified as critical. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST Request Handler. The manipulation of the argument ip6addr/url/vpnPassword/vpnUser leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/panda666-888/vuls/blob/main/totolink/x15/formFilter_ip6addr.md; https://github.com/panda666-888/vuls/blob/main/totolink/x15/formFilter_url.md; https://vuldb.com/?ctiid.317830
CVE: CVE-2024-58265
Published: 2025-07-27
Description: The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.
CVSS Score: 3.1 (LOW)
CWE: CWE-642
References: https://crates.io/crates/snow; https://github.com/mcginty/snow/security/advisories/GHSA-7g9j-g5jg-3vv3; https://rustsec.org/advisories/RUSTSEC-2024-0011.html
CVE: CVE-2024-58266
Published: 2025-07-27
Description: The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.
CVSS Score: 3.2 (LOW)
CWE: CWE-116
References: https://crates.io/crates/shlex; https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27; https://rustsec.org/advisories/RUSTSEC-2024-0006.html
CVE: CVE-2025-8243
Published: 2025-07-27
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED] and classified as critical. This issue affects some unknown processing of the file /boafrm/formMapDel of the component HTTP POST Request Handler. The manipulation of the argument devicemac1 leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-787
References: https://github.com/panda666-888/vuls/blob/main/totolink/x15/formMapDel.md; https://vuldb.com/?ctiid.317831; https://vuldb.com/?id.317831
CVE: CVE-2025-8244
Published: 2025-07-27
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been classified as critical. Affected is an unknown function of the file /boafrm/formMapDelDevice of the component HTTP POST Request Handler. The manipulation of the argument macstr leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120, CWE-77
References: https://github.com/panda666-888/vuls/blob/main/totolink/x15/formMapDelDevice.md; https://vuldb.com/?ctiid.317832; https://vuldb.com/?id.317832
CVE: CVE-2025-8245
Published: 2025-07-27
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAPVLAN of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/panda666-888/vuls/blob/main/totolink/x15/formMultiAPVLAN.md; https://vuldb.com/?ctiid.317833; https://vuldb.com/?id.317833
CVE: CVE-2025-8246
Published: 2025-07-27
Description: A vulnerability was found in TOTOLINK X15 1.0.0-B20[PII_REDACTED]. It has been rated as critical. Affected by this issue is some unknown functionality of the file /boafrm/formRoute of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/panda666-888/vuls/blob/main/totolink/x15/formRoute.md; https://vuldb.com/?ctiid.317834; https://vuldb.com/?id.317834
CVE: CVE-2023-53157
Published: 2025-07-28
Description: The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-130
References: https://crates.io/crates/rosenpass; https://github.com/advisories/GHSA-6ggr-cwv4-g7qg; https://github.com/rosenpass/rosenpass/commit/93439858d1c44294a7b377f775c4fc897a370bb2
CVE: CVE-2025-8247
Published: 2025-07-28
Description: A vulnerability classified as critical has been found in Projectworlds Online Admission System 1.0. This affects an unknown part of the file /admin.php. The manipulation of the argument markof leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/ht4266394/cve/issues/1; https://vuldb.com/?ctiid.317835; https://vuldb.com/?id.317835
CVE: CVE-2023-53158
Published: 2025-07-28
Description: The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-78
References: https://crates.io/crates/gix-transport; https://github.com/GitoxideLabs/gitoxide/pull/1032; https://github.com/advisories/GHSA-rrjw-j4m2-mf34
CVE: CVE-2025-8248
Published: 2025-07-28
Description: A vulnerability classified as critical was found in code-projects Online Ordering System 1.0. This vulnerability affects unknown code of the file /signup.php. The manipulation of the argument firstname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/xiajian-qx/cve-xiajian/issues/2; https://vuldb.com/?ctiid.317836
CVE: CVE-2025-8249
Published: 2025-07-28
Description: A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s3.php. The manipulation of the argument credits leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Dingzenggonpo/cve/issues/2; https://vuldb.com/?ctiid.317837
CVE: CVE-2025-8250
Published: 2025-07-28
Description: A vulnerability, which was classified as critical, was found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s4.php. The manipulation of the argument credits leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Dingzenggonpo/cve/issues/3; https://vuldb.com/?ctiid.317838
CVE: CVE-2022-50237
Published: 2025-07-28
Description: The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation for extracting a private key.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-497
References: https://crates.io/crates/ed25519-dalek; https://github.com/MystenLabs/ed25519-unsafe-libs; https://rustsec.org/advisories/RUSTSEC-2022-0093.html
CVE: CVE-2025-8251
Published: 2025-07-28
Description: A vulnerability has been found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s4.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/mynlxx/CVE-ZhuChengQing/issues/8; https://vuldb.com/?ctiid.317839
CVE: CVE-2023-53159
Published: 2025-07-28
Description: The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-126
References: https://crates.io/crates/openssl; https://github.com/sfackler/rust-openssl/issues/1965; https://rustsec.org/advisories/RUSTSEC-2023-0044.html
CVE: CVE-2023-53160
Published: 2025-07-28
Description: The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic.
CVSS Score: 2.9 (LOW)
CWE: CWE-125
References: https://crates.io/crates/sequoia-openpgp; https://github.com/advisories/GHSA-25mx-8f3v-8wh7; https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/
CVE: CVE-2023-53161
Published: 2025-07-28
Description: The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic.
CVSS Score: 2.9 (LOW)
CWE: CWE-125
References: https://crates.io/crates/buffered-reader; https://github.com/advisories/GHSA-29mf-62xx-28jq; https://gitlab.com/sequoia-pgp/sequoia/-/tags/buffered-reader%2Fv1.0.2
CVE: CVE-2025-8252
Published: 2025-07-28
Description: A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s5.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/mynlxx/CVE-ZhuChengQing/issues/9; https://vuldb.com/?ctiid.317840
CVE: CVE-2025-8253
Published: 2025-07-28
Description: A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s6.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/mynlxx/CVE-ZhuChengQing/issues/10; https://vuldb.com/?ctiid.317841
CVE: CVE-2025-8254
Published: 2025-07-28
Description: A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/XiaoJiesecqwq/CVE/issues/15; https://vuldb.com/?ctiid.317842; https://vuldb.com/?id.317842
CVE: CVE-2025-8255
Published: 2025-07-28
Description: A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /register.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/Dingzenggonpo/cve/issues/4; https://vuldb.com/?ctiid.317843
CVE: CVE-2025-8256
Published: 2025-07-28
Description: A vulnerability classified as critical has been found in code-projects Online Ordering System 1.0. Affected is an unknown function of the file /admin/product.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://code-projects.org/; https://github.com/zzb1388/cve/issues/28; https://vuldb.com/?ctiid.317844
CVE: CVE-2025-8257
Published: 2025-07-28
Description: A vulnerability classified as problematic was found in Lobby Universe Lobby App up to 2.8.0 on Android. Affected by this vulnerability is an unknown functionality of the file AndroidManifest.xml of the component com.maverick.lobby. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.maverick.lobby.md; https://vuldb.com/?ctiid.317845; https://vuldb.com/?id.317845
CVE: CVE-2025-8258
Published: 2025-07-28
Description: A vulnerability, which was classified as problematic, has been found in Cool Mo Maigcal Number App up to 1.0.3 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.sdmagic.number. The manipulation leads to improper export of android application components. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-926
References: https://github.com/KMov-g/androidapps/blob/main/com.sdmagic.number.md; https://vuldb.com/?ctiid.317846; https://vuldb.com/?id.317846
CVE: CVE-2025-8267
Published: 2025-07-28
Description: Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid. This oversight allows attackers to craft requests targeting these multicast addresses.
CVSS Score: 8.2 (HIGH)
CWE: CWE-918
References: https://gist.github.com/lirantal/[PII_REDACTED]df824cb3abe60d13c65e04; https://github.com/felippe-regazio/ssrfcheck/commit/9507b49fd764f2a1a1d1e3b9ee577b7545e6950e; https://github.com/felippe-regazio/ssrfcheck/issues/5
CVE: CVE-2025-8259
Published: 2025-07-28
Description: A vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /grid/vgrid_server.php of the component Web interface. Such manipulation of the argument xajaxargs leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 5.1.1 and 5.4.1 can resolve this issue. It is suggested to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-77, CWE-78, CWE-78
References: https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Remote_Code_Execution_in_Vaelsys_V4_Platform.md; https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0001.html; https://vuldb.com/submit/616920
CVE: CVE-2025-8260
Published: 2025-07-28
Description: A security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the component Web interface. Performing a manipulation of the argument xajaxargs results in use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 5.1.1 and 5.4.1 is able to mitigate this issue. Upgrading the affected component is recommended.
CVSS Score: 3.1 (LOW)
CWE: CWE-327, CWE-328, CWE-327
References: https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_Access_Leads_to_Sensitive_Information_Leakage_in_Vaelsys_V4_Platform.md; https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0002.html; https://vuldb.com/submit/616922
CVE: CVE-2025-8261
Published: 2025-07-28
Description: A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "Based on Vaelsys' analysis, the reported behavior does not allow actions beyond those already permitted to authenticated administrative users, and no change in system configuration or operational practices is necessary."
CVSS Score: 7.3 (HIGH)
CWE: CWE-266, CWE-285
References: https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_User_Creation_Vulnerability_Exists_in_Vaelsys_V4_Platform.md; https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0003.html; https://vuldb.com/submit/616924
CVE: CVE-2025-8262
Published: 2025-07-28
Description: A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-1333, CWE-1333
References: https://github.com/yarnpkg/yarn/pull/9199; https://github.com/yarnpkg/yarn/pull/9199/commits/97731871e674bf93bcbf29e9d3258da8685f3076; https://vuldb.com/?ctiid.317850