Alertas de Seguridad de la Información

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_verified claim. Attackers can present a token with an unverified email address matching a victim's account to inherit the vi…

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instanc…

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.

Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

Se descubrió una flaw en hawtio-operator que afecta despliegues en modo cluster. El operador crea un OAuthClient con aprobación automática sin secreto de cliente (cliente público), permitiendo que un tenant malicioso redirija URIs y realice ataques de suplantación de identidad. Esto expone sistemas en plataformas OpenShift y Kubernetes en México y LATAM a compromiso de credenciales y movimiento lateral en infraestructura containerizada.

NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

Unauthenticated Broken Authentication in Ziina

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component