Vulnerabilidades

Vulnerabilidad de omisión de autorización a través de una clave controlada por el usuario en AdvancedCoding wpDiscuz wpdiscuz permite explotar niveles de seguridad de control de acceso incorrectamente configurados. Este problema afecta a wpDiscuz: desde n/a hasta menor o igual a 7.6.40.

Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en AMP-MODE Review Disclaimer review-disclaimer permite XSS Almacenado. Este problema afecta a Review Disclaimer: desde n/a hasta menor o igual que 2.0.3.

Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6.

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient…

The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed data of any plant by altering the plant_id in the request.

The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a public AJAX endpoint that retrieves form submission data without performing authorization checks to verify ownership or access rights. This makes it possible…

HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. This is fixed in 24.12.14, 25.0.3, and 25.3.1. The earliest affected version is 24.7.3.

AIS-catcher es un receptor AIS multiplataforma. Antes de la versión 0.64, existe una vulnerabilidad de desbordamiento negativo de enteros en la lógica de análisis MQTT de AIS-catcher. Esta vulnerabilidad permite a un atacante activar un desbordamiento de búfer de montón masivo enviando un paquete MQTT malformado con…

AIS-catcher es un receptor AIS multiplataforma. Antes de la versión 0.64, una vulnerabilidad de desbordamiento de búfer de pila ha sido identificada en la clase AIS::Message de AIS-catcher. Esta vulnerabilidad permite a un atacante escribir aproximadamente 1KB de datos arbitrarios en un búfer de 128 bytes. Este…

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow,…

Vulnerabilidad de lectura fuera de límites en ASR1903 y ASR3901 en ASR Lapwing_Linux en Linux (módulos nr_fw). Esta vulnerabilidad está asociada con los archivos de programa Code/nr_fw/DLP/src/NrCgi.C. Este problema afecta a Lapwing_Linux: antes del 26/11/2025.

A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted HTTP…

Una vulnerabilidad en la interfaz de gestión basada en web de Cisco Catalyst Center Virtual Appliance podría permitir a un atacante remoto no autenticado redirigir a un usuario a una página web maliciosa. Esta vulnerabilidad se debe a una validación de entrada incorrecta de los parámetros de solicitud HTTP. Un…

Una vulnerabilidad en la interfaz de gestión basada en web de Cisco Catalyst Center podría permitir a un atacante remoto no autenticado realizar un ataque de cross-site scripting (XSS) contra un usuario de la interfaz de un dispositivo afectado. Esta vulnerabilidad se debe a una validación insuficiente de la entrada…

Una vulnerabilidad en la API REST de Cisco Catalyst Center podría permitir a un atacante remoto autenticado ejecutar comandos arbitrarios en un contenedor restringido como el usuario root. Esta vulnerabilidad se debe a una validación insuficiente de la entrada proporcionada por el usuario en los parámetros de…

Una vulnerabilidad en Cisco Catalyst Center podría permitir a un atacante remoto autenticado ejecutar operaciones que deberían requerir privilegios de Administrador. El atacante necesitaría credenciales de usuario válidas de solo lectura. Esta vulnerabilidad se debe a un control de acceso basado en roles (RBAC)…

Improper Control of Generation of Code ('Code Injection') vulnerability in acowebs Dynamic Pricing With Discount Rules for WooCommerce aco-woo-dynamic-pricing allows Code Injection.This issue affects Dynamic Pricing With Discount Rules for WooCommerce: from n/a through <= 4.5.9.

A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to certain API endpoints. An attacker could exploit this vulnerability by sending…

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a malicious file to the…

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by uploading a crafted file to the web…

A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by sending a…

A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulnerability is due to improper authentication mechanisms in the…

A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system. This vulnerability is due to improper authentication mechanisms that are…

A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a logic error when processing a RADIUS access request for a…

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because certain files lack proper data protection mechanisms. An attacker with read-only Administrator privileges could…