Vulnerabilidades

Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked. This vulnerability may allow unauthorized access…

The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. The discovery of valid usernames can increase the risk of brute-force and social engineering attacks. Attackers can leverage this information to…

Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en una embarcación. Antes de la versión 2.25.0, los puntos finales de inicio de sesión HTTP (POST /login y POST /signalk/v1/auth/login) están protegidos por express-rate-limit (predeterminado: 100 intentos por ventana de 10…

FastGPT es una plataforma de construcción de Agentes de IA. Desde la versión 4.14.10 hasta antes de la versión 4.14.13, el componente agent-sandbox de FastGPT es vulnerable a ejecución remota de código (RCE) no autenticada. El script de inicio entrypoint.sh inicializa code-server con la bandera --auth none y enlaza el…

MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is…

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate valid usernames by measuring the application's response time. This issue has been…

A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form…

A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than…

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or…

An authentication bypass vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to create a local user account, bypassing the configured external identity provider. When external authentication was enabled, the signup endpoint did not properly enforce the authentication…

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel,…

Jupyter Server es el backend para las aplicaciones web de Jupyter. En las versiones 2.17.0 y anteriores, el secreto utilizado para firmar las cookies de autenticación se persiste en un archivo estático en ~/.local/share/jupyter/runtime/jupyter_cookie_secret y nunca se rota cuando un usuario cambia su contraseña.…

Jupyter Server es el backend para aplicaciones web de Jupyter. En las versiones 2.17.0 y anteriores, la validación del encabezado Origin utiliza re.match() de Python para verificar los orígenes entrantes contra el valor de configuración allow_origin_pat. Debido a que re.match() solo se ancla al inicio de la cadena y…

Vulnerabilidad de desbordamiento de búfer basado en montículo en mod_proxy_ajp del Servidor HTTP Apache. Si mod_proxy_ajp se conecta a un servidor AJP malicioso, este servidor AJP puede enviar un mensaje AJP malicioso de vuelta a mod_proxy_ajp y hacer que escriba 4 bytes controlados por el atacante después del final…

Jupyter Server es el backend para las aplicaciones web de Jupyter. En las versiones 2.17.0 y anteriores, una vulnerabilidad de salto de ruta en la API REST permite a un usuario autenticado escapar del 'root_dir' configurado y acceder a directorios hermanos cuyos nombres comienzan con el mismo prefijo que el…

En versiones de Eclipse BaSyx Java Server SDK anteriores a 2.0.0-milestone-10, la función de Delegación de Operaciones no valida la URI de destino de las solicitudes delegadas. Un atacante remoto no autenticado puede explotar esta falla de diseño para forzar al servidor BaSyx a ejecutar solicitudes HTTP POST ciegas a…

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass…

A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can…

A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or…

Jupyter Server es el backend para las aplicaciones web de Jupyter. En las versiones de jupyter_server hasta la 2.17.0, el parámetro de consulta next en el flujo de inicio de sesión está insuficientemente validado en 'LoginFormHandler._redirect_safe()', lo que permite redirecciones a dominios externos arbitrarios a…

Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool). The supported versions that is affected is 1.0.1-1.0.156. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MCP Server Helper Tool.…

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.

A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.

A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.