CVE Vulnerability Catalog

The CSN.1 protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The MBIM protocol dissector in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

The ZigBee ZCL protocol dissector in Wireshark versions 4.6.0 to 4.6.8 can crash, leading to denial of service.

The PEAK CAN TRC file parser in Wireshark versions 4.6.0 to 4.6.8 can crash, leading to denial of service.

SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

The Sharkd utility in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can crash, leading to denial of service.

Crash in the SPDY protocol dissector in versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service.

The TTL file parser in Wireshark versions 4.6.0 to 4.6.8 has an infinite loop, leading to denial of service.

GitLab CE/EE contains a missing authorization check on linked work items within visible epics. An authenticated user could read private child issue contents, including titles and descriptions, from projects they had no access to.

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device's intended operation.

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

A vulnerability in the Teradata provider for Apache Airflow affects the example Dag, which defines parameters as free text and templates them into operators, allowing a user with lower privileges to inject SQL fragments. This can lead to code execution under the task's connection and redirect the task to other connections.

GitLab CE/EE has a vulnerability allowing arbitrary JavaScript execution in another user's browser session due to improper sanitization of path components in the merge request diff viewer. Affects versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1.

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. An `account` value containing `/`, `?` or `#` demoted the intended domain to a path, query or fragment, leaving the attacker in control of the request host. The same unvalidated value was also used to build the OAuth token-request URL and the Cortex Agent base URL.

A vulnerability in the Google provider for Apache Airflow involves improper interpolation of file and folder names into Google Drive queries without escaping quote characters. An attacker controlling names (e.g., by creating objects in buckets) can inject additional clauses into the query, potentially redirecting transfers to unauthorized locations or swapping downloaded files.

A vulnerability in the Teradata provider for Apache Airflow causes cloud storage credentials to be embedded directly into SQL statements by the S3ToTeradataOperator and AzureBlobStorageToTeradataOperator. The credentials end up in Airflow task logs and Teradata query logs (DBQL), where they are not masked. The issue affects the default authentication path when no AUTHORIZATION object is configured.

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet, which can be used for configuration file upload, leading to information disclosure and integrity compromise. The servlet is intended for testing in non-production environments.

A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. No further technical details are provided in the description.

A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft, or other unauthorized actions.