Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/06/2026

[CVE-2026-5228] Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile …

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-43985] Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.1…

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUpdate` as a state-changing administrator endpoint, but the route does not enforce `POST` and does not use any anti-CSRF token. In the default form and JWT-based authentication mode, the administrator session cookie is issued with `SameSite=Lax`, which still permits top-level cross…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-44393] An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitM…

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is acce…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-43984] Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.1…

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only `logFile` view then reads that log file and embeds it into an HTML response without…

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-38570] bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers…

bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-36176] GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plain…

GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. This allows physically-proximate attackers to extract these active tokens to perform unauthorized operations via monitoring the serial UART interface.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10863] A security issue was fixed in the correlations over-correlation endpoint where the order query param…

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query orderi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-59874] HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is det…

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-46638] Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An …

Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to a Denial of Service (DoS).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25745] WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability th…

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'tid' parameter. Attackers can send GET requests to the admin interface with malicious 'tid' values to extract sensitive database information using time-based blind SQL injection techniques.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25732] PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers t…

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to extract sensitive database information including usernames, passwords, and version details.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25733] NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that a…

NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input. Attackers can craft a payload with overwritten SEH and NSEH pointers through the Restrictions custom filter field to trigger code execution when the Find function is invoked.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25735] AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers t…

AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers to overwrite structured exception handling pointers by supplying an excessively long URL string. Attackers can craft a malicious URL, paste it into the Open URL dialog, and trigger SEH-based code execution to run arbitrary commands with user privileges.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25736] LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to …

LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.exe or other arbitrary commands.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25728] Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to e…

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25730] Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to …

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to pages.php with crafted id values using error-based SQL injection techniques to extract database credentials, usernames, and version information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2019-25726] All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated …

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames, databases, and version detail…

nvdaltovulnerabilidad CVSS 8.2 NVD

H Alto vulnerabilidad

04/06/2026

[CVE-2025-52612] HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflect…

HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10840] A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBi…

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or cert-manager CRDs are present on the cluster, any authenticated user can disrupt workload scheduling, tamper with scheduling priorities, delete…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10843] A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator…

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restricted to cluster-owned resources, enabling cross-scope impact after credential compromise.

nvdaltovulnerabilidad CVSS 7.2 NVD