Vulnerabilidades

Frappe Learning Management System (LMS) es un sistema de aprendizaje que ayuda a los usuarios a estructurar su contenido. Versiones anteriores a 2.41.0, una falla en la lógica de autorización del lado del servidor permitía a los usuarios autenticados realizar acciones más allá de sus roles asignados en múltiples…

El plugin CRM Memberships para WordPress es vulnerable a escalada de privilegios a través de restablecimiento de contraseña en todas las versiones hasta la 2.5, inclusive. Esto se debe a la falta de comprobaciones de autorización y autenticación en la acción AJAX 'ntzcrm_changepassword'. Esto hace posible que…

El plugin CRM Memberships para WordPress es vulnerable a la creación no autorizada de etiquetas de membresía debido a una comprobación de capacidad faltante en la función 'ntzcrm_add_new_tag' en todas las versiones hasta la 2.5, inclusive. Esto hace posible que atacantes no autenticados creen etiquetas de membresía…

RomM (ROM Manager) permite a los usuarios escanear, enriquecer, navegar y jugar sus colecciones de juegos con una interfaz limpia y responsiva. Versiones anteriores a 4.4.1 y 4.4.1-beta.2, un usuario autenticado puede eliminar colecciones que pertenecen a otros usuarios enviando directamente una solicitud DELETE al…

RomM (ROM Manager) permite a los usuarios escanear, enriquecer, navegar y jugar sus colecciones de juegos con una interfaz limpia y receptiva. Versiones anteriores a 4.4.1 y 4.4.1-beta.2, los usuarios pueden leer colecciones privadas / colecciones inteligentes pertenecientes a otros usuarios accediendo directamente a…

RomM (ROM Manager) permite a los usuarios escanear, enriquecer, navegar y jugar sus colecciones de juegos con una interfaz limpia y responsiva. RomM contiene múltiples vulnerabilidades de carga de archivos sin restricciones que permiten a los usuarios autenticados subir archivos SVG o HTML maliciosos. Cuando se accede…

In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavaScript. The payload executes when an administrator clicks the image link to view the avatar, resulting in stored cross-site scripting (XSS). Successful exploitation may lead to…

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOptions::run() save handler. This makes it possible for…

Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the little used --security option, in particular the forms --security=apparmor:<profile> and --security=selinux:<label> which otherwise put restrictions on operations that containers can…

Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.

Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, certain requests were vulnerable to path traversal attacks, wherein some files from the server could be retrieved if the full path was known. Sites hosted on Frappe Cloud, and even other setups that are behind a reverse proxy like NGINX…

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.

Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.

Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.

Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network.

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.

A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to write arbitrary files under certain conditions.

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values.

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.

Una vulnerabilidad de revelación de información sensible existe en el componente de manejo de errores de la aplicación ATISoluciones CIGES versión 2.15.6 y anteriores. Cuando ciertas condiciones inesperadas desencadenan excepciones no manejadas, la aplicación devuelve mensajes de error detallados y trazas de pila al…

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications…

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3, tvOS 18.5, visionOS 2.5, watchOS 11.5. An attacker in physical proximity may be able to cause an out-of-bounds read in kernel…

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.