Alertas de Seguridad de la Información

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec r…

NLTK versiones anteriores a 3.10.3 contienen una vulnerabilidad de ejecución remota de código (RCE) en cargadores pickle que confían en espacios de nombres completos en lugar de funciones seguras específicas. Atacantes pueden crear cargas pickle maliciosas invocando funciones peligrosas como ReppTokenizer._execute y numpy.f2py.crackfortran.myeval durante la carga de modelos o tokens, comprometiendo servidores de procesamiento de lenguaje natural en empresas de LATAM que procesen datos no verificados.

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.