Aisle Research

Remote unauthenticated attackers can cause a denial of service resulting in CPU exhaustion in the Key Distribution Center (KDC) by sending an AS-REQ or TGS-REQ containing a large number of elements in a SEQUENCE OF field over TCP. This occurs because the `decode sequence of()` function in `lib/krb5/asn.1/asn1 encode.c` grows the decoded element array one entry at a time, leading to quadratic ASN.1 decoding (a process where the time to decode increases quadratically relative to the input size).

An authorization bypass allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances across different projects. The system verifies permissions against the provided `projectCode` but does not confirm if the target resource actually belongs to that project. Consequently, a user with permissions in one project can use that project's code alongside a resource identifier from another project to bypass access restrictions. This allows attackers to alter workflow availability and interfere with task execution in unauthorized projects via the following endpoints: - 'POST /projects/{projectCode}/schedules/{id}/online' - 'POST /projects/{projectCode}/schedules/{id}/offline' - 'POST /projects/{projectCode}/workflow-definition/{code}/release'

An unauthenticated remote attacker can cause a denial of service (DoS) by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This action forces the service to create an unbounded number of detached threads, which exhausts system resources including memory and file descriptors, resulting in the degradation or complete unavailability of the service for legitimate users.

A race condition exists during directory creation with owner assignment. A local unprivileged attacker who controls a writable parent directory can replace a newly created directory with a symbolic link (symlink) before the `chown()` function is applied. This allows the attacker to redirect the ownership change to an arbitrary file, which may result in unauthorized modification of sensitive files or information disclosure.

A crash in the Toshiba file parser can lead to a denial of service.

A crash in the RRC protocol dissector can lead to a denial of service. A dissector is a software component that breaks down network traffic into a human-readable format.

A NULL pointer dereference in the Bluetooth BR/EDR FHS protocol dissector can lead to a crash, resulting in a denial of service.

An abnormal exit in the BUSMASTER file parser allows a denial of service.

A crash in the Kerberos protocol dissector allows for a denial of service. This is caused by an out-of-bounds read, which occurs when the software attempts to read data outside the intended memory boundary of a buffer.

A crash in the Pcapng file parser allows for a denial of service. This occurs due to an out-of-bounds read, which happens when the software attempts to read data outside the intended memory boundary of the buffer.

A NULL pointer dereference in the CMS protocol dissector can lead to a crash, resulting in a denial of service.

A crash in the ESS protocol dissector occurs due to the use of an uninitialized variable, which can lead to a denial of service.

A crash in the 3gpp phone log file parser allows for a denial of service. This is caused by an out-of-bounds write, which occurs when the software writes data past the end of the intended buffer, potentially corrupting memory.

A Use After Free issue in the CMS protocol dissector can lead to a crash, resulting in a denial of service.

A NULL pointer dereference in the H.245 protocol dissector can lead to a crash, resulting in a denial of service. A protocol dissector is a software component that breaks down network traffic into a human-readable format.

A crash in the Bluetooth HFP Profile protocol dissector allows for a denial of service. This is caused by an out-of-bounds read, which occurs when the software attempts to read data outside the intended memory boundary.

A crash in the C12.22 protocol dissector allows a denial of service. A dissector is a software component that breaks down network traffic into a human-readable format.

A NULL pointer dereference in the X.509IF protocol dissector can lead to a crash, resulting in a denial of service.

A crash in the BLF file parser on Windows allows a denial of service.

A heap-based buffer overflow in the C12.22 protocol dissector can lead to a crash, resulting in a denial of service. A dissector is a software component that breaks down network packets into a human-readable format.