compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation without effective command suppression. Version 0.30.0 has no stop-commands window, while version 0.31.0 prints this error outside its stop-commands window. A pull request can place a committed symlink on that path to a directory whose name contains a newline followed by a workflow command, causing the SARIF-directory error to issue commands in the job log. Only the Action with sarif-file pointing into a subdirectory is affected; a workspace-root SARIF file, the compose-lint package, the pre-commit hook, and the Docker image do not expose this message. This issue is fixed in version 0.32.0.

Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.

Windows TCP/IP Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Windows Graphics Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

Windows Graphics Kernel Information Disclosure Vulnerability

Use of uninitialized resource in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

Windows Imaging Component Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.

Desktop Window Manager Elevation of Privilege Vulnerability

Release of invalid pointer or reference in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance.

Insecure Storage of Sensitive Information Allowing File Manipulation in Johnson Controls iSTAR Devices

CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

Windows Kernel Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Kernel Information Disclosure Vulnerability

Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information with a physical attack.

Windows PCI Bus Driver Elevation of Privilege Vulnerability

Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.

Windows Subsystem for Linux Elevation of Privilege Vulnerability

Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

Microsoft DirectMusic Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Microsoft DirectMusic allows an authorized attacker to execute code locally.

Windows Remote Desktop Client Information Disclosure Vulnerability

Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information locally.

Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability

Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.

Windows Installer Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

Windows Error Reporting Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

Windows TCP/IP Elevation of Privilege Vulnerability

Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

XXE Vulnerability in Eclipse AAS4J XML Validator Allows File Disclosure and Outbound Requests

In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls it) validates untrusted XML with a default JAXP `Validator` that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read local files from the host, send their contents out-of-band to an attacker-controlled server, and make the validating process send arbitrary outbound requests (SSRF). Validation still returns no errors. Details: - Vulnerable code: `dataformat-xml/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/xml/XmlSchemaValidator.java`. `schema.newValidator().validate(new StreamSource(...))` runs without `ACCESS_EXTERNAL_DTD` / `ACCESS_EXTERNAL_SCHEMA` restrictions and without `disallow-doctype-decl`. - Second entry point: `dataformat-aasx/src/main/java/org/eclipse/digitaltwin/aas4j/v3/dataformat/aasx/AASXValidator.java`. The AAS XML part of an `.aasx` package is passed unchanged to the vulnerable validator. - `XmlDeserializer` (Jackson/Woodstox) is not affected, because DTD support is disabled by default there. - Present since the initial import of the code base (commit `cc9da52`). - Fix: harden the validator by setting `ACCESS_EXTERNAL_DTD` and `ACCESS_EXTERNAL_SCHEMA` to `""` and rejecting `DOCTYPE` declarations. The bundled `AAS.xsd` does not need DTDs, so no functionality is lost.