Alertas de Seguridad de la Información

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and obtain or refresh tokens.

Se detectó una vulnerabilidad en Ahsay AhsayCBS (versiones ≤10.3.2) que compromete la función de autenticación checkSysPwd mediante manipulación del parámetro random en la API. El ataque es remoto y el exploit está públicamente disponible. Afecta principalmente a empresas en LATAM que usan este software de backup en cloud híbrido, exponiendo acceso no autorizado a sistemas de respaldo altas.

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal…

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.