Alertas de Seguridad de la Información

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level …

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use…

An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal.

Se ha identificado una vulnerabilidad crítica de escalada de privilegios sin autenticación en Jawn versión 1.4.2 y anteriores, con puntuación CVSS 9.8. Un atacante remoto puede explotar esta falla para obtener acceso administrativo sin credenciales válidas. Empresas en México y LATAM que utilicen Jawn en producción enfrentan riesgo inmediato de compromiso total del sistema.

FreightCo versiones 1.1.15 y anteriores contienen una vulnerabilidad crítica (CVSS 9.8) que permite inyección de objetos PHP sin requerir autenticación. Esta falla afecta directamente a empresas logísticas y de transporte en LATAM que utilizan esta plataforma para gestión de cargas, permitiendo a atacantes ejecutar código arbitrario y comprometer completamente los sistemas. La ausencia de controles de autenticación previos amplifica significativamente el riesgo de explotación remota.

Se ha identificado una vulnerabilidad de inclusión local de archivos (LFI) sin autenticación en WP Cafe Pro versiones anteriores a 3.0.15, con puntuación CVSS 9.8. Esta falla permite a atacantes remotos acceder a archivos sensibles del servidor, incluyendo configuraciones con credenciales de bases de datos. Afecta principalmente a tiendas en línea y sitios de comercio electrónico que utilizan este plugin en WordPress.

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure…

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in a…

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.