Securin

In the `PersistentDataset` function within `monai/data/dataset.py`, the software rejects the simultaneous use of `track meta=True` and `weights only=True`. This forces users caching MetaTensors to use `torch.load(hashfile, weights only=False)`. Additionally, cache helpers in `monai/data/utils.py` utilize `pickle.loads` on cached content and generate cache keys using `hashlib.md5`. A local user with write access to a shared or world-writable `cache dir` can place a malicious pickle file. When another user's pipeline reads this cache, the file is deserialized, leading to arbitrary code execution in that user's context.

A general user can mint admin access tokens through the '/access-tokens' endpoint.

Inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC MsLogonIIAuth) allows a network attacker to disclose credentials. In the file `rfb/dh.cpp`, the Diffie-Hellman key exchange uses parameters fitting in an unsigned 64-bit integer, controlled by `DH MAX BITS`. Such keys can be broken quickly using Pollard's rho algorithm. Furthermore, the `rng()` function generates the private exponent by multiplying three `libc rand()` values seeded from `time(NULL)`, making the exponent recoverable by a passive observer due to the limited internal state and time-based seed. An attacker observing the MS-Logon II handshake can derive the shared DH key to decrypt the username and password. This issue only affects legacy MS-Logon II connections.

An integer overflow exists in the RFB protocol failure-response parsing path within the `vncviewer/ClientConnection.cpp` file. The issue occurs when the 4-byte network-supplied `reasonLen` field is passed as `reasonLen+1` to the `CheckBufferSize()` function. If `reasonLen` is 0xFFFFFFFF, the unsigned 32-bit addition overflows to 0, leading the system to allocate only 256 bytes. Subsequently, the `ReadString()` function calls `ReadExact()` to read the original 4 GiB length into the small 256-byte heap buffer, resulting in a heap buffer overflow. This condition can be triggered pre-authentication via `rfbConnFailed` (auth-scheme negotiation) and `rfbVncAuthFailed` (post-handshake) message types. A malicious VNC server or a man-in-the-middle attacker on the RFB stream can exploit this when a victim connects, potentially leading to remote code execution as the user running the viewer.

A denial-of-service issue exists within the Graphics: ImageLib component.