Vulnerabilidades

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB CoreSense™ M10.This issue affects CoreSense™ HM: through 2.3.1; CoreSense™ M10: through 1.4.1.12.

El plugin Truelysell Core para WordPress es vulnerable a Cambio Arbitrario de Contraseña de Usuario en versiones hasta la 1.8.6, inclusive. Esto se debe a que el plugin proporciona acceso controlado por el usuario a objetos, permitiendo a un usuario eludir la autorización y acceder a recursos del sistema. Esto hace…

Bibliotecas Alloy Core en la raíz del ecosistema Rust Ethereum. Antes de las versiones 0.8.26 y 1.4.1, un error de pánico no capturado, provocado por una entrada malformada a alloy_dyn_abi::TypedData, podría conducir a una denegación de servicio (DoS) a través de eip712_signing_hash(). El software con requisitos de…

El plugin Lisfinity Core - Lisfinity Core utilizado para el plugin del tema de WordPress Lisfinity de pebas® para WordPress es vulnerable a escalada de privilegios en todas las versiones hasta la 1.4.0, inclusive. Esto se debe a que el plugin asigna el rol de editor por defecto. Si bien se establecen limitaciones con…

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

El plugin Lisfinity Core - Lisfinity Core, utilizado para el plugin del tema de WordPress pebas® Lisfinity para WordPress, es vulnerable a la escalada de privilegios a través de la actualización de contraseña en todas las versiones hasta la 1.4.0, inclusive. Esto se debe a que el plugin no valida correctamente la…

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A…

Toma de control de cuentas en Corezoid 6.6.0 en la implementación de OAuth2 a través de una redirección abierta en el parámetro redirect_uri permite a los atacantes interceptar códigos de autorización y obtener acceso no autorizado a las cuentas de las víctimas.

The llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcoded directory path `/tmp/llama_index` is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core pgs-core allows SQL Injection.This issue affects PGS Core: from n/a through <= 5.9.0.

Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.

Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through <= 3.0.0.266.

Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.

apidoc-core is the core parser library to generate apidoc result following the apidoc-spec. A Prototype Pollution vulnerability in the preProcess function of apidoc-core versions thru 0.15.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as…

A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0.40D.msi of the component Installer. Executing manipulation can lead to permission issues. The attack needs to be launched locally. You should upgrade the…

web3-core-method es un paquete diseñado para crear los métodos en los módulos web3. Una vulnerabilidad de Contaminación de Prototipos en la función attachToObject de web3-core-method versión 1.10.4 y anteriores permite a los atacantes inyectar propiedades en Object.prototype mediante el suministro de una carga útil…

El paquete web3-core-subscriptions es un paquete diseñado para gestionar suscripciones web3. Una vulnerabilidad de Contaminación de Prototipos en la función attachToObject de web3-core-subscriptions versión 1.10.4 y anteriores permite a los atacantes inyectar propiedades en Object.prototype mediante el suministro de…

Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Cross Site Request Forgery.This issue affects WorkScout-Core: from n/a through < 1.7.06.

Missing Authorization vulnerability in brandexponents Oshine Core oshine-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oshine Core: from n/a through <= 1.5.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.11.0.

Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cross-Site Scripting (XSS).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform…

The Robcore Netatmo plugin for WordPress is vulnerable to SQL Injection via the ‘module_id’ attribute of the robcore-netatmo shortcode in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…

El paquete Altiris Core Agent Updater (AeXNSC.exe) es propenso a una vulnerabilidad de elevación de privilegios a través de secuestro de DLL.

CoreDNS is a DNS server that chains plugins. Starting in version 1.2.0 and prior to version 1.12.4, the CoreDNS etcd plugin contains a TTL confusion vulnerability where lease IDs are incorrectly used as TTL values, enabling DNS cache pinning attacks. This effectively creates a DoS condition for DNS resolution of…