Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20276] Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthentic…

Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the type parameter. Attackers can send GET requests to index.php with the option=com_simgenealogy, view=latest parameters and inject malicious SQL in the type parameter to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20277] Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author …

Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on the search results page. Attackers can inject SQL code through POST requests to the search endpoint to extract database information using boolean-based blind SQL injection techniques.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20263] Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unau…

Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_focalpoint, view=location, and a crafted id parameter containing SQL commands to extract sensitive database information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20264] Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticat…

Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_sponsorwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information including crede…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20265] Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated …

Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wallid parameter. Attackers can send GET requests to index.php with the option=com_flipwall&task=click&wallid parameter containing SQL injection payloads to extract sensitive database information.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20257] Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthentica…

Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the ajaxaction.flag_question task. Attackers can inject malicious SQL code via the stu_quiz_id or flag_quest parameters to manipulate database queries and extract sensitive information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2017-20254] Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated…

Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with the option=com_userbench&view=detail&userid parameter containing SQL injection payloads to extract sensitive database information including credenti…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

19/06/2026

[CVE-2026-52909] In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on…

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device. john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0). Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device i…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2023-54353] Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that…

Chromacam 4.0.3.0 contains an unquoted service path vulnerability in the PsyFrameGrabberService that allows local attackers to execute arbitrary code by placing malicious executables in unquoted path directories. Attackers with write access to C:\ or subdirectories like C:\Program Files (x86)\Personify\ can place a malicious Program.exe or PsyFrameGrabberService.exe file that executes with LocalSy…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20095] Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastVi…

Matrix42 Remote Control Host 3.20.0031 contains an unquoted service path vulnerability in the FastViewerRemoteService and FastViewerRemoteProxy services that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can place a malicious executable in the Program Files directory with a crafted name to be executed by the service during startup, gaining elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25747] Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path that…

Network Inventory Advisor 5.0.26.0 installs the niaservice service with an unquoted binary path that allows local attackers to escalate privileges by placing malicious executables in intermediate directories. Attackers can exploit the unquoted path in the service configuration to execute arbitrary code with LocalSystem privileges when the service starts or restarts.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20089] Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to exec…

Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. When installed from directories containing spaces, attackers can place malicious executables in the path to be executed with elevated privileges during service startup or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20090] Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in th…

Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path running with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20085] Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that…

Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-48895] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker co…

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.2 NVD

N Alto vulnerabilidad

19/06/2026

[CVE-2026-48138] There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bo…

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

19/06/2026

[CVE-2026-48139] There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that…

There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service by triggering a crash.  Successful exploitation requires an attacker to provide an unknown value to the data moniker service. This affects NI grpc-device 2.17.0 and prior versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-41156] Software installed and run as a non-privileged user may conduct improper GPU system calls to cause m…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario. A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing …

nvdaltovulnerabilidad CVSS 7.7 NVD

E Alto vulnerabilidad

19/06/2026

[CVE-2026-11576] The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP …

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to ope…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56075] PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI mo…

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient…

nvdaltovulnerabilidad CVSS 8.8 NVD