Guigu98

**Name of the Vulnerable Software and Affected Versions** pageant versions prior to 0.2.3 **Description** The `MemoryMap::read` function in the `pageant/src/wmmessage.rs` file trusts a peer-controlled `u32` response length provided via the 8192-byte shared-memory mapping accessed by `AgentClient::connect pageant`. A local process impersonating the Pageant window can cause `query pageant direct` to allocate approximately 4 GiB of memory and copy data beyond the mapped view. This can lead to a crash of a russh client and potentially expose adjacent committed memory. **Recommendations** Update to version 0.2.3.

**Name of the Vulnerable Software and Affected Versions** Russh versions prior to 0.63.2 **Description** An authenticated remote peer can trigger a memory exhaustion condition by sending `SSH MSG KEXINIT` without the mandatory `SSH MSG KEX ECDH INIT` and subsequently flooding `SSH MSG CHANNEL OPEN` messages. This occurs because `SessionKexState::InProgress` prevents the `priority receiver` in `russh/src/server/session.rs` from being drained. Consequently, the server continues to process network input and enqueues a `ChannelOpenReply` for every request on an unbounded channel, allowing a single connection to consume memory until the process is terminated. **Recommendations** Update to version 0.63.2.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions prior to 8.6.88 Parse Server versions 9.0.0 through 9.10.1-alpha.6 **Description** An authentication bypass exists in the built-in LDAP authentication adapter. The adapter forwards the client-supplied password to the directory without verifying if a password was provided and treats any non-error response as successful authentication. A zero-length credential converts an LDAP simple bind into an unauthenticated mechanism, which some directories, such as Active Directory in its default configuration, may accept by mapping the connection to anonymous. This allows an unauthenticated attacker with a known directory username to obtain a valid session token and take over the account. This issue only affects deployments with the LDAP authentication adapter enabled and directories that do not refuse unauthenticated simple binds. **Recommendations** Update to version 8.6.88. Update to version 9.10.1-alpha.7. Disable the LDAP authentication adapter if it is not required.