Alertas de Seguridad de la Información

Amundsen frontend hasta versión 4.3.0 renderiza descripciones de tablas, dashboards y características sin sanitizar HTML en componentes ResourceListItem, permitiendo inyección de código malicioso a través del servicio de metadatos o Elasticsearch. Atacantes pueden ejecutar JavaScript en el navegador de todos los usuarios que visualicen resultados de búsqueda, comprometiendo sesiones y datos sensibles en plataformas de datos corporativas.

Se ha identificado una vulnerabilidad de inyección SQL en SourceCodester School Registration and Fee System versión 1.0, específicamente en el archivo /bilal/normal/save_stud.php. Un atacante remoto puede manipular el parámetro Status para ejecutar comandos SQL maliciosos y comprometer la base de datos de estudiantes y registros académicos. Esta vulnerabilidad es especialmente alta para instituciones educativas en México y LATAM que utilizan este sistema para gestionar matrículas y cobros de colegios.

Strapi versiones 4.x hasta 4.26.2 y 5.x anteriores a 5.48.1 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en el componente de vista previa WYSIWYG del gestor de contenidos. Un usuario con rol de Author puede inyectar etiquetas script maliciosas en campos de texto enriquecido que se ejecutan en sesiones de Editor o Super Admin, permitiendo compromiso de cuentas administrativas y acceso no autorizado a sistemas de gestión de contenidos en empresas de LATAM.

LangBot versiones anteriores a 4.10.11 genera claves de recuperación de contraseña con solo 24 bits de entropía sin protección contra ataques de fuerza bruta. Un atacante remoto que conozca el correo del administrador puede comprometer la cuenta mediante solicitudes concurrentes al endpoint de restablecimiento de contraseña sin autenticación. Esto afecta directamente la seguridad perimetral de sistemas altas en empresas latinoamericanas que utilizan este software.

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to b…

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early thr…

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET_KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. T…

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged ro…

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length …

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted…

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond…

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).