Alertas de Seguridad de la Información

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chave_correta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafis…

Dell OpenManage Server Administrator en versiones anteriores a 11.1.0.3 contiene credenciales hardcodeadas que permiten acceso no autenticado remoto. Un atacante podría obtener acceso no autorizado a la consola de administración de servidores, comprometiendo la infraestructura alta. Afecta especialmente a centros de datos y empresas con servidores Dell en LATAM que utilicen esta herramienta sin actualizar.

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.

The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcR…

PraisonAI versiones anteriores a 0.1.6 contienen una vulnerabilidad de autenticación crítica (CVSS 9.8) donde la clave JWT_SECRET se asigna a un valor público conocido cuando las variables de entorno no están configuradas correctamente. Un atacante remoto no autenticado puede falsificar tokens JWT con identidades arbitrarias, comprometiendo sistemas multi-agente en producción. Afecta especialmente a empresas LATAM que implementan PraisonAI sin sobrescribir explícitamente las credenciales de desarrollo.

PraisonAI versiones anteriores a 0.1.6 utiliza una clave HS256 predeterminada y pública cuando las variables de entorno no están configuradas, permitiendo que atacantes sin autenticación firmen tokens JWT arbitrarios. Esta falla afecta a sistemas que ejecuten plataformas de agentes multiequipo en configuraciones de desarrollo accidentalmente expuestas en producción, comprometiendo completamente el control de acceso.

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early thr…

A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.