Alertas de Seguridad de la Información

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of p…

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_au…

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this …

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To rem…

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining acc…

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header wit…

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string vi…

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured l…

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE

NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing …

A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via

AVideo contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en el plugin CustomizeUser que permite a administradores inyectar scripts maliciosos mediante el parámetro field_name sin sanitización en el endpoint add.json.php. Los scripts se ejecutan cuando usuarios visualizan formularios de perfil o páginas de información adicional, afectando la integridad de datos y sesiones de usuarios en plataformas de video bajo demanda. En LATAM, esta vulnerabilidad impacta especialmente a proveedores de contenido, universidades y plataformas educativas que utilizan AVideo en su infraestructura de distribución.

AVideo contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en el plugin LoginControl que no codifica correctamente las claves PGP públicas. Un atacante autenticado puede inyectar código JavaScript malicioso mediante una clave PGP fraudulenta, el cual se ejecuta en la sesión del administrador al visualizar la pestaña de perfil de usuario. Con CVSS 8.7, afecta principalmente plataformas de video on-demand y educación en línea en LATAM que usan AVideo sin actualizar.

AVideo contiene una vulnerabilidad de cross-site scripting (XSS) almacenada en el plugin YPTWallet que afecta el manejo de valores de CryptoWallet. Los datos no se escapan HTML antes de guardarse en wallet_log.information, permitiendo que administradores ejecuten código malicioso al revisar solicitudes de retiro pendientes en pendingRequests.php. Empresas de streaming y plataformas de monetización en LATAM usando esta versión enfrentan riesgo de compromisos administrativos.

WWBN AVideo contiene una vulnerabilidad de falsificación de solicitud del lado del servidor (SSRF) en la función _json_decode que permite a atacantes no autenticados enviar rutas de archivos o URLs HTTP a login.json.php para leer archivos locales o acceder a servicios internos. Los resultados se interpretan como credenciales de acceso, exponiendo configuraciones sensibles, bases de datos y tokens de sistemas en empresas de LATAM que utilizan este software para streaming de video.