Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).  On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation. If the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file. Before the problem is fixed, users are recommended to leverage application control for KMS URL parameter in readers (versions 1.12-1.18). After the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter  will have two options then: leverage application control for KMS URL parameter in readers, or enable file-controlled KMS URL (via a new app parameter). The latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.

Sensitive information is leaked into NeuVector’s manager container logs

An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5.

Blind, read-only SQL injection in Zabbix API via sortfield parameter

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

Windows DHCP Server Remote Code Execution Vulnerability

Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Windows DHCP Server Information Disclosure Vulnerability

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.

Windows DHCP Server Information Disclosure Vulnerability

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.

Windows DHCP Server Information Disclosure Vulnerability

Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.

Windows Graphics Component Remote Code Execution Vulnerability

Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Windows NTFS Elevation of Privilege Vulnerability

Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally.

Windows CD-ROM Driver Information Disclosure Vulnerability

Out-of-bounds read in Windows CD-ROM Driver allows an unauthorized attacker to disclose information with a physical attack.

Windows DNS Server Denial of Service Vulnerability

Use after free in Windows DNS allows an unauthorized attacker to deny service over a network.

Windows Hyper-V Remote Code Execution Vulnerability

Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute code locally.

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

Windows DHCP Server Denial of Service Vulnerability

Missing release of memory after effective lifetime in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Windows Kernel Elevation of Privilege Vulnerability

Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Windows Biometric Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.