Vulnerabilities

A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks.<br /> <br /> <br /> <br /> <br /> Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server.<br /> <br /> <br /> <br /> <br /> sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.

Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.<br /> <br /> <br /> <br /> <br /> Apache MINA SSHD is a Java library for client-side and server-side SSH. <br /> The optional sshd-ldap component provides support for integrating <br /> password and publickey authentication on the server side with an LDAP <br /> server.<br /> <br /> <br /> <br /> <br /> sshd-ldap is an optional component. SSH servers implemented with Apache <br /> MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication.<br /> <br /> Other Apache MINA SSHD servers are not affected.<br /> <br /> <br /> <br /> <br /> Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*".<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit this issue to cause incorrect data processing or a denial-of-service condition.

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism.<br /> <br /> <br /> <br /> <br /> In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass.<br /> <br /> <br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache <br /> MINA SSHD is a Java library for client-side and server-side SSH.<br /> <br /> <br /> <br /> <br /> Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD server such <br /> that authenticated SSH clients can remotely execute git commands via the JGit library <br /> on git repositories stored on the server. In CVE-2026-58624 this mechanism was restricted to only a few git commands, including "git archive" without "--output" or "-o" options such that the resulting archive would not be written on the server but instead sent back to the client over the SSH connection.<br /> <br /> <br /> <br /> <br /> The fix done for CVE-2026-58624 was insufficient as it missed removing the single-argument "-o=file.zip" version of the command parameter from the "archive" command.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH.<br /> <br /> <br /> <br /> <br /> Component sshd-scp of Apache MINA SSHD provides a Java implementation of SCP. The SCP command protocol is line-oriented with LF-terminated lines. The protocol handler in sshd-scp did not impose any limit on the length of such protocol lines. A malicious peer just sending a junk command containing a never-ending sequence of characters but never a LF would cause the receiver to allocate memory to store this whole junk command, exhausting memory and crashing the application with an OutOfMemoryError.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue by enforcing an upper limit on the length of SCP protocol lines.

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.<br /> <br /> <br /> <br /> <br /> Apache <br /> MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP.<br /> <br /> <br /> <br /> <br /> The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH server.<br /> <br /> <br /> <br /> <br /> Apache MINA SSHD is a Java library for client- and server-side SSH. In the server part of the library, a mechanism to perform "asynchronous authentication" exists. A server implemented with Apache MINA SSHD must contain explicit code to make use of this feature. The implementation of this feature was flawed and could potentially lead to skipping checking the signature in public-key or hostbased authentication, or returning a wrong result.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to Apache MINA SSHD 2.20.0 or 3.0.0-M6, which fix the logic error and which additionally forbid the use of this "asynchronous authentication" mechanism with the public-key or hostbased authentication schemes: if used, the SSH session will be closed and the server will log an entry indicating that asynchronous authentication may be used only with password or keyboard-interactive authentication.

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data.

MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submitted record, including caller-supplied fields such as the primary key and event_id.<br /> <br /> An authenticated attacker could inject a primary key or event_id into the delegation payload to retarget an existing delegation record to any event on the instance. Because a delegation row grants the requesting organisation read access to the event it references, this effectively granted read access to arbitrary events belonging to other organisations. If the target organisation subsequently accepted the delegation, ownership of the event was transferred and the original record was deleted.<br /> <br /> Preconditions:<br /> <br /> - An authenticated user with the delegation permission (perm_delegate)<br /> <br /> - The MISP.delegation server setting must be enabled<br /> <br /> Impact:<br /> <br /> - Confidentiality: read access to any event on the instance<br /> <br /> - Integrity: overwriting existing delegation records and transferring event ownership<br /> <br /> Affected versions: MISP

MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit), the application sanitizes the flat record by stripping the primary key and pinning the event_id or object_id to the caller&amp;#39;s context. However, the underlying ORM&amp;#39;s set() method gives priority to a nested key whose name matches the model alias and discards the outer scalar fields.<br /> <br /> An authenticated user with basic write permissions can exploit this by embedding a nested block under the model alias key inside their request. The sanitization logic (id removal, event_id pinning) is applied to the outer record, but the ORM binds to the inner record instead, which carries an attacker-chosen id and event_id. This allows the attacker to overwrite, re-parent, or soft-delete rows belonging to other organizations or events they have no read access to.<br /> <br /> Impact:<br /> <br /> - Cross-tenant data integrity compromise (attribute values rewritten, objects re-parented to attacker events, rows soft-deleted)<br /> <br /> - Affects multiple entity types: Attribute, Object, EventReport, Sighting, AttributeTag, ShadowAttribute<br /> <br /> - Requires only a low-privilege authenticated account with perm_add<br /> <br /> Affected versions:

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim&amp;#39;s behalf. This flaw allows a remote attacker to set or overwrite student grades without authorization.