Zack Miele

**Name of the Vulnerable Software and Affected Versions** dogtag-pki and pki-core (affected versions not specified) **Description** The issue is related to an authentication bypass in dogtag-pki and pki-core due to an original error. This can be exploited by a remote attacker to escalate their privileges. The token authentication scheme can be bypassed using a LDAP injection. By passing the query string parameter `sessionID=*`, an attacker can authenticate with an existing session saved in the LDAP directory server, potentially leading to an escalation of privilege. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenShift (affected versions not specified) **Description** An information disclosure flaw was found in OpenShift's internal image registry operator. The `AZURE CLIENT SECRET` can be exposed through an environment variable defined in the pod definition, but is limited to Azure environments. An attacker controlling an account that has high enough permissions to obtain pod information from the openshift-image-registry namespace could use this obtained client secret to perform actions as the registry operator's Azure service account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenShift Virtualization (affected versions not specified) **Description** An information disclosure flaw was found in OpenShift Virtualization, related to the DownwardMetrics feature, which exposes host metrics to virtual machine guests and is enabled by default. This issue could expose limited host metrics of a node to any guest in any namespace without being explicitly enabled by an administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KubeVirt (affected versions not specified) **Description** A NULL pointer dereference flaw was found in KubeVirt, allowing an attacker with access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service. This can be achieved by issuing a high number of calls to `vm-dump-metrics --virtio` and then deleting the virtual machine. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FRRouting (affected versions not specified) **Description** A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the `unicast flag` set, the `interval field` set to 0, or any TLV that contains a sub-TLV with the `Mandatory flag` set to enter an infinite loop and cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSH SFTP server (affected versions not specified) **Description** A missing allocation check in the SFTP server when processing read requests can cause a NULL dereference under low-memory conditions. A malicious client can request up to 4GB SFTP reads, leading to the allocation of large buffers without checking for failure. This can likely crash the authenticated user's SFTP server connection, especially in forking-based implementations, and may also cause a Denial of Service (DoS) for legitimate users in thread-based servers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** The issue exists due to insufficient sanitization of user-supplied data in the blog search function. A remote attacker can trick the victim into following a specially crafted link, allowing the execution of arbitrary HTML and script code in the user's browser within the context of the vulnerable website. This flaw enables a remote attacker to perform cross-site scripting (XSS) attacks, potentially leading to the theft of confidential information, modification of the webpage's appearance, and execution of phishing attacks or drive-by downloads. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.