Vulnerabilidades

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media…

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track…

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that…

Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject arbitrary HTML and JavaScript code through the search parameter. Attackers can craft malicious URLs with JavaScript payloads in the search parameter to execute…

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the…

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which…

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege…

A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if…

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to…

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger…

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence,…

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is…

En las versiones afectadas de Octopus Server, los permisos no se verificaban correctamente, lo que resultaba en que cualquier usuario autenticado pudiera realizar cambios a nivel de servidor utilizando un determinado endpoint de la API a pesar de recibir un error.

Una vulnerabilidad en las versiones 1.12.0 a 2.17.0 de jupyter-server permite a un atacante eludir la validación de origen CORS cuando se utiliza la configuración 'allow_origin_pat'. El problema surge del uso de 're.match()' para validar el encabezado 'Origin', que solo se ancla al inicio de la cadena. Esto permite a…

React Router es un router para React. En las versiones 7.0.0 a 7.14.x de react-router y las versiones 2.10.0 a 2.17.4 de @remix-run/server-runtime, ciertas solicitudes especialmente diseñadas pueden consumir recursos desproporcionados del servidor a través de una expansión de ruta ilimitada en el endpoint __manifest,…

Control de acceso inadecuado en el componente de validación de permisos en Devolutions Server 2026.1.19 y versiones anteriores permite a un usuario autenticado con privilegios de edición de entradas modificar información de activos sin el permiso requerido.

Control de acceso inadecuado en la función de descubrimiento de cuentas PAM en Devolutions Server 2026.1.19 y versiones anteriores permite a un usuario autenticado sin privilegios administrativos eliminar configuraciones de escaneo de descubrimiento de red.

Una vulnerabilidad de salto de ruta existe en jupyter-server versión 2.17.0 debido a una comprobación incorrecta del límite del directorio raíz en la función _get_os_path() dentro de jupyter_server/services/contents/fileio.py. La comprobación utiliza startswith(root) sin añadir un separador de ruta final, lo que…

Una falla de seguridad ha sido descubierta en el servidor Orthanc DICOM hasta la versión 1.12.11. Este problema afecta la función DcmItem::read del archivo OrthancFramework/Sources/DicomParsing/FromDcmtkBridge.cpp del componente DCMTK Parser. Realizar una manipulación resulta en desbordamiento de búfer basado en pila.…

IBM WebSphere Application Server 9.0 y 8.5 se ve afectado por una validación incorrecta de datos proporcionados por el usuario durante la deserialización al usar el componente SAML Web Single Sign-On. Esto podría resultar en ejecución remota de código a través de una solicitud HTTP manipulada cuando se combina con una…

IBM WebSphere Application Server 9.0 y 8.5 es vulnerable a una posible ejecución remota de código debido a la deserialización de datos no confiables a través de puntos finales JAX-WS con WS-Security.

IBM WebSphere Servidor de Aplicaciones 9.0 y 8.5 es vulnerable a la ejecución remota de código causada por la elusión de controles de seguridad.

IBM WebSphere Servidor de Aplicaciones 9.0 y 8.5 es vulnerable a la suplantación de identidad.