Alertas de Seguridad de la Información

A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply…

docker-socket-proxy no valida correctamente los endpoints de lectura en el namespace /containers de la API de Docker cuando la variable CONTAINERS está configurada, permitiendo a atacantes acceder a archivos arbitrarios y descargar sistemas de archivos completos de contenedores. Esta vulnerabilidad afecta directamente a infraestructuras containerizadas en empresas LATAM que ejecutan Docker en entornos multi-inquilino o con segregación insuficiente de permisos.

Headroom's LLM proxy contiene una vulnerabilidad de autenticación insuficiente (CVSS 9.1) en el encabezado x-headroom-user-id que permite a atacantes acceder y modificar datos de memoria de otros usuarios sin autorización. El fallo afecta rutas de chat completion y websocket en headroom/proxy/handlers/openai.py. Empresas que usan este proxy para gestionar modelos de lenguaje corren riesgo de exposición de datos sensibles y suplantación de identidad.

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from save() alone, while the path getter returns path.join(this.server.stacksDir, this.name) and Stack.getStack builds path.join(server.stacksDir, stackName) with no check. The socket handlers in backend/agent-socket-handlers/docke…

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the pro…

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr fro…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and…

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal an…

Se ha identificado una vulnerabilidad de deserialización insegura en SPLWare esProc que afecta la función ObjectInputStream.readUnshared en SocketData.java. Un atacante remoto puede explotar esta falla para ejecutar código arbitrario en sistemas que ejecuten versiones vulnerables, comprometiendo servidores de procesamiento de datos en empresas de LATAM que utilizan esta plataforma de análisis paralelo.

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwa…

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against ar…