Mitchell Benjamin

**Name of the Vulnerable Software and Affected Versions** Apache MINA SSHD versions prior to 2.19.0 Apache MINA SSHD versions prior to 3.0.0-M5 **Description** Improper certificate validation occurs during server-side OpenSSH user authentication. The server fails to check or validate the `force-command` or `verify-required` options embedded in certificates. This allows a user to authenticate with a certificate containing a `force-command` option and potentially execute commands other than the one specified, depending on the server implementation. **Recommendations** Upgrade to version 2.19.0. Upgrade to version 3.0.0-M5.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 4.6.0 through 4.6.6 **Description** A crash in the pcapng file parser allows a denial of service. This occurs when the software processes a specially crafted pcapng file, leading to an application failure. **Recommendations** Update Wireshark to a version newer than 4.6.6.

**Name of the Vulnerable Software and Affected Versions** Jenkins Credentials Binding Plugin versions 720.v3f6decef43ea and earlier **Description** Insufficient sanitization of file names for file and zip file credentials allows attackers who can provide credentials to a job to write files to arbitrary locations on the node filesystem. This path traversal issue can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node. **Recommendations** Update the Jenkins Credentials Binding Plugin to a version later than 720.v3f6decef43ea .