Insufficient Control Flow Management

Overview vyper is a Pythonic Smart Contract Language for the EVM. Affected versions of this package are vulnerable to Insufficient Control Flow Management through optimization in the concat function. An attacker can skip evaluation of side effects when the length of an argument provided to the...

CVE-2025-47774

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the slice builtin can elide side effects when the output length is 0, and the source bytestring is a builtin msg.data or .code. The reason is that for these source locations, the...

CVE-2025-47774

CVE-2025-47774 relates to Vyper (Pythonic language for the EVM). The issue affects Vyper versions up to and including 0.4.2rc1 where slice() can elide side effects when length is 0 for certain source bytestrings (e.g., msg.data or .code). The root cause is that the length >= 1 check is skipped...

CVE-2025-47285 Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, concat may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions...

CVE-2025-32500

Cross-Site Request Forgery CSRF vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widget: from n/a through = 0.4.2...

CVE-2025-32500

Cross-Site Request Forgery CSRF vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widget: from n/a through = 0.4.2...

CVE-2025-32500

CVE-2025-32500 : Codescar Radio Widget (versions up to 0.4.2) contains a CSRF flaw that enables Stored XSS. The issue affects the Codescar Radio Widget plugin and is currently Unpatched (no fix in the connected docs). CVSS v3.1 base score 7.1 (HIGH) according to the metrics, with network impact, ...

CVE-2024-8952

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...

CVE-2024-8952

The CVE-2024-8952 SSRF vulnerability affects composiohq/composio v0.4.2 in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. The issue enables an attacker to read files, access AWS metadata, and interact with local services via crafted requests. Affected component is the endpoint ...

CVE-2025-27220

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service ReDoS vulnerability exists in the UtilescapeElement method...

Amazon Linux 2 : python-jwcrypto (ALAS-2025-2763)

The version of python-jwcrypto installed on the remote host is prior to 0.4.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2763 advisory. JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cau...

PT-2025-5769 · Unknown · Expand-Object

Name of the Vulnerable Software and Affected Versions: expand-object version 0.4.2 Description: A prototype pollution in the lib function of expand-object allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For expand-object version 0.4.2, consider...

expand-object 安全漏洞

expand-object is a library by Jon Schlinkert, a personal developer, that uses simple symbols to expand strings into JavaScript objects. A security vulnerability exists in expand-object version v0.4.2, which stems from the lib function containing a prototype contamination vulnerability...

Brute Force

Overview netunicorn-library is a netunicorn contrib library Affected versions of this package are vulnerable to Brute Force. An attacker could gain unauthorized access by exploiting this vulnerability. Remediation Upgrade netunicorn-library to version 0.4.2 or higher. References - GitHub Commit -...

OPENSUSE-SU-2024:12813-1 dino-0.4.2-1.1 on GA media

These are all security issues fixed in the dino-0.4.2-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2024-3119

A buffer overflow vulnerability exists in all versions of sngrep since v0.4.2, due to improper handling of 'Call-ID' and 'X-Call-ID' SIP headers. The functions sipgetcallid and sipgetxcallid in sip.c use the strncpy function to copy header contents into fixed-size buffers without checking the dat...

PT-2024-23122

Name of the Vulnerable Software and Affected Versions AuthKit library for Next.js versions prior to 0.4.2 Description The issue allows a user to reuse an expired session by controlling the x-workos-session header. This can be exploited to bypass session expiration. Recommendations For versions...

openSUSE: Security Advisory for sccache (SUSE-SU-2023:3526-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2020-28407

In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall...

CVE-2023-39342

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI dangerzone-cli command logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is...