Alertas de Seguridad de la Información

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials …

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials fo…

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in th…

Se identificó una vulnerabilidad de Cross Site Scripting (XSS) sin autenticación en el plugin 12 Step Meeting List en versiones hasta la 3.19.16, permitiendo a atacantes inyectar código malicioso que afecta a usuarios visitantes. Empresas en LATAM que administren sitios comunitarios, grupos de apoyo o directorios de reuniones con este plugin están expuestas a robo de sesiones, credenciales y datos sensibles. Con CVSS 7.1, representa un riesgo significativo si el sitio maneja información personal o transacciones.