Alertas de Seguridad de la Información

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could inject Search Processing Language (SPL) into saved-search dispatch requests. This could allow for unauthorized access to all relevant data and affect system integrity within Splunk Enterprise. The vulnerability is possible because Splunk Enterprise does not cor…

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language (SPL) pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all relevant data, affect system integrity, and affect availability of the Splunk platform instance. The S…

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language (SPL) pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant data and system integrity available to that user and affect system availability. The vulnerability is …

Budibase versiones anteriores a 3.40.0 contiene una vulnerabilidad de inyección NoSQL en su integración con MongoDB que permite a atacantes inyectar operadores MongoDB a través de parámetros de consulta, eludiendo controles de acceso por usuario. Los atacantes pueden leer documentos arbitrarios, ejecutar JavaScript malicioso y modificar datos en bases de datos MongoDB conectadas. Esta vulnerabilidad afecta principalmente a empresas en LATAM que utilizan Budibase para desarrollo de aplicaciones internas y plataformas de datos sin validación de entrada robusta.

Budibase Server versiones anteriores a 3.40.0 contienen una vulnerabilidad de inyección NoSQL en el endpoint de ejecución de consultas MongoDB. Atacantes con permisos de escritura de consultas pueden manipular parámetros JSON sin sanitizar, alterando queries para leer, modificar o eliminar documentos arbitrarios. El riesgo es alta (CVSS 8.3) en entornos que exponen esta funcionalidad a usuarios no confiables o integran Budibase en plataformas empresariales en LATAM.

Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/resolve/query_rewriter.go passes regexp filter strings into generated DQL without quoting or validating the /pattern/flags form, allowing crafted GraphQL query or mutation filters to inject DQL operators, disclose unintended nodes, or expand modification and deletion targets. This issue is fixed in ver…