Securin

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.2 **Description** A general user can mint admin access tokens through the '/access-tokens' endpoint. **Recommendations** Upgrade to version 3.4.2.

**Name of the Vulnerable Software and Affected Versions** UltraVNC versions prior to 1.8.2.3 **Description** Inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC MsLogonIIAuth) allows a network attacker to disclose credentials. In the file `rfb/dh.cpp`, the Diffie-Hellman key exchange uses parameters fitting in an unsigned 64-bit integer, controlled by `DH MAX BITS`. Such keys can be broken quickly using Pollard's rho algorithm. Furthermore, the `rng()` function generates the private exponent by multiplying three `libc rand()` values seeded from `time(NULL)`, making the exponent recoverable by a passive observer due to the limited internal state and time-based seed. An attacker observing the MS-Logon II handshake can derive the shared DH key to decrypt the username and password. This issue only affects legacy MS-Logon II connections. **Recommendations** Update to a version newer than 1.8.2.2. Restrict the use of the MS-Logon II authentication scheme to minimize the risk of credential disclosure.

**Name of the Vulnerable Software and Affected Versions** UltraVNC viewer versions prior to 1.8.2.3 **Description** An integer overflow exists in the RFB protocol failure-response parsing path within the `vncviewer/ClientConnection.cpp` file. The issue occurs when the 4-byte network-supplied `reasonLen` field is passed as `reasonLen+1` to the `CheckBufferSize()` function. If `reasonLen` is 0xFFFFFFFF, the unsigned 32-bit addition overflows to 0, leading the system to allocate only 256 bytes. Subsequently, the `ReadString()` function calls `ReadExact()` to read the original 4 GiB length into the small 256-byte heap buffer, resulting in a heap buffer overflow. This condition can be triggered pre-authentication via `rfbConnFailed` (auth-scheme negotiation) and `rfbVncAuthFailed` (post-handshake) message types. A malicious VNC server or a man-in-the-middle attacker on the RFB stream can exploit this when a victim connects, potentially leading to remote code execution as the user running the viewer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the RFB stream to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 152 Firefox ESR versions prior to 140.12 Firefox ESR versions prior to 115.37 Thunderbird versions prior to 152 Thunderbird versions prior to 140.12 **Description** A denial-of-service issue exists within the Graphics: ImageLib component. **Recommendations** Update to version 152 for Firefox. Update to version 140.12 for Firefox ESR. Update to version 115.37 for Firefox ESR. Update to version 152 for Thunderbird. Update to version 140.12 for Thunderbird.