Alertas de Seguridad de la Información

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The …

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was c…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

El plugin Real Estate Manager Pro para WordPress es vulnerable a escalada de privilegios en versiones hasta la 12.8.6. Un defecto en la función allow_attachment_actions() permite que usuarios autenticados con acceso de Suscriptor eleven sus permisos al manipular IDs de archivos adjuntos. Esta vulnerabilidad afecta principalmente a inmobiliarias y plataformas de propiedades en LATAM que dependen de este plugin para gestionar contenido multimedia y control de acceso.

El plugin Wholesale Market para WordPress (versiones hasta 2.2.2) contiene una vulnerabilidad de escalada de privilegios mediante la acción AJAX ced_wholesale_request_send. El defecto en la validación del nonce y autenticación permite a usuarios autenticados elevar sus permisos sin restricciones. Afecta tiendas de comercio electrónico en LATAM que utilizan este complemento para gestión de ventas mayoristas.

El plugin 'Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms' para WordPress (versiones hasta 5.1) contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro 'action' por falta de sanitización. Atacantes no autenticados pueden inyectar scripts maliciosos que se ejecutan cuando usuarios acceden a páginas con formularios afectados. Este riesgo impacta directamente sitios web de empresas, tiendas en línea y portales institucionales en LATAM que usan este plugin.

El plugin 'Cookie Banner for GDPR / CCPA – WPLP Cookie Consent' en WordPress es vulnerable a inyección de scripts almacenados (Stored XSS) a través del parámetro 'regionArray' en versiones hasta la 4.3.5 debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas con el plugin, afectando potencialmente datos de visitantes y credenciales en sitios de comercio electrónico, gobiernos digitales y financieras de la región.

El plugin 'Online Booking & Scheduling Calendar for WordPress by vcita' contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro 'business_id' debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar scripts maliciosos que se ejecutan cuando usuarios acceden a páginas afectadas. Esto representa un riesgo alta para sitios de reservas y agendamiento en LATAM que confían en este plugin para capturar clientes.

El plugin bLoyal: Loyalty & Promotions para WordPress en versiones hasta 3.1.611.78 contiene una vulnerabilidad de escalada de privilegios (CVSS 8.8) que permite a atacantes ejecutar acciones administrativas sin autenticación válida. Las acciones AJAX `save_bloyal_configuration_data` y `save_bloyal_accesskeyverification_data` carecen de validaciones de capacidad y nonce, mientras que la función `bloyal_customer_auto_login` confía incondicionalmente en parámetros controlables por el usuario. Esto afecta directamente a tiendas de comercio electrónico en LATAM que usan este plugin para gestionar programas de lealtad y promociones.

El plugin Propovoice: All-in-One Client Management System en WordPress versiones hasta 1.7.8 contiene una falla de escalada de privilegios en su endpoint REST. El parámetro `role` no valida contra roles permitidos ni verifica capacidades `promote_users`, permitiendo a atacantes elevar permisos a administrador. Afecta principalmente a empresas LATAM que usan WordPress para gestión de clientes y servicios profesionales.

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sani…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier saniti…

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary…

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only K_OBJ_MSGQ and K_OBJ_STACK; there was no K_OBJ_TIMER case. A dynamically-allocated, initialized, and armed k_timer keeps its embedded struct _timeout d…

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.