Alertas de Seguridad de la Información

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request body and a new password to overwrite credentials of any non-administrator account without verification.

Pig versiones anteriores a 4.1.0 presentan una vulnerabilidad de omisión de autenticación en el endpoint /register/password que descarta la verificación de contraseña actual, permitiendo a atacantes remotos reescribir credenciales de cualquier cuenta incluyendo administrador con CVSS 9.1. Esta falla expone sistemas de gestión de identidades en empresas LATAM a toma de control administrativo completo sin credenciales válidas.

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.11 and 7.0.34, MyAccountController::postAccountInfoForm in src/app/Http/Controllers/MyAccountController.php at POST /admin/edit-account-info passes request data from $request->except(['_token']) to the user model inste…