CVE Vulnerability Catalog

The Catapult DCT2000 protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The IEEE C37.118 Synchrophasor protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 has a memory leak, leading to denial of service.

The Microsoft Network Monitor file parser in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 has a large loop, leading to denial of service.

The CSN.1 protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The MBIM protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The ZigBee ZCL protocol dissector in Wireshark versions 4.6.0 to 4.6.8 can crash, leading to denial of service.

The PEAK CAN TRC file parser in Wireshark versions 4.6.0 to 4.6.8 can crash, leading to denial of service.

The Sharkd utility in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The TTL file parser in Wireshark versions 4.6.0 to 4.6.8 has an infinite loop, leading to denial of service.

GitLab CE/EE contains a missing authorization check on linked work items within visible epics. An authenticated user could read private child issue contents, including titles and descriptions, from projects they had no access to.

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

A vulnerability in the Teradata provider for Apache Airflow affects the example Dag, which defines parameters as free text and templates them into operators, allowing a user with lower privileges to inject SQL fragments. This can lead to code execution under the task's connection and redirect the task to other connections.

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. An `account` value containing `/`, `?` or `#` demoted the intended domain to a path, query or fragment, leaving the attacker in control of the request host. The same unvalidated value was also used to build the OAuth token-request URL and the Cortex Agent base URL.

A vulnerability in the Google provider for Apache Airflow involves improper interpolation of file and folder names into Google Drive queries without escaping quote characters. An attacker controlling names (e.g., by creating objects in buckets) can inject additional clauses into the query, potentially redirecting transfers to unauthorized locations or swapping downloaded files.

A vulnerability in the Teradata provider for Apache Airflow causes cloud storage credentials to be embedded directly into SQL statements by the S3ToTeradataOperator and AzureBlobStorageToTeradataOperator. The credentials end up in Airflow task logs and Teradata query logs (DBQL), where they are not masked. The issue affects the default authentication path when no AUTHORIZATION object is configured.

A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. No further technical details are provided in the description.

Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability.

GitLab EE contains improper authorization enforcement. An authenticated user with guest-level permissions could read private security policy content they were not authorized to access.

In the dash shell, the printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b can write one or two bytes past that reservation.

In the dash shell, when built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames or otherwise feed that matcher can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU.