Vulnerabilidades

El punto final de informes CSP tenía la intención de limitar los informes CSP registrados a 1 KB, pero permitió incorrectamente informes de hasta 1 MB antes del truncamiento. En implementaciones donde el punto final es accesible por clientes no confiables, esto podría permitir a los atacantes generar un volumen…

Una vulnerabilidad fue identificada en el flujo de trabajo de creación de propuestas de ShadowAttribute. La acción de añadir aceptaba datos de solicitud de ShadowAttribute controlados por el usuario sin eliminar el campo 'id' antes de guardar el registro. Debido a que el framework subyacente trata una clave primaria…

Vulnerabilidad por falta de autorización en Drupal Date iCal permite la navegación forzada. Este problema afecta a Date iCal: desde 0.0.0 hasta antes de 4.0.15.

La vulnerabilidad de Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') en Drupal Colorbox Inline permite cross-site scripting (XSS). Este problema afecta a Colorbox Inline: desde 0.0.0 hasta antes de 2.1.1.

Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en Drupal Obfuscate permite cross-site scripting (XSS). Este problema afecta a Obfuscate: desde 0.0.0 anterior a 2.0.2.

Faraday es una capa de abstracción de biblioteca cliente HTTP que proporciona una interfaz común sobre muchos adaptadores. Las versiones 2.0.0 a 2.14.1 aún permiten la anulación de host relativa al protocolo cuando el objetivo de la solicitud se pasa como un objeto URI (en lugar de una cadena) a…

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the…

GLPI es un paquete de software gratuito de gestión de activos y TI. En las versiones 11.0.0 a la 11.0.6, un usuario autenticado con permiso de LECTURA de formularios puede exportar la estructura de formularios no autorizados. Este problema ha sido solucionado en la versión 11.0.7.

En versiones de mlflow/mlflow anteriores a la 3.11.0, la función 'get_or_create_nfs_tmp_dir()' en 'mlflow/utils/file_utils.py' crea directorios temporales con permisos de escritura para todos (0o777), y la función '_create_model_downloading_tmp_dir()' en 'mlflow/pyfunc/__init__.py' crea directorios con permisos de…

A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be…

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password…

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes,…

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends…

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing…

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not…

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling private/internal…

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json.…

Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters. The lack of proper input sanitization allows an attacker to inject malicious code that is persistently stored in the database. When other users or…

Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the…

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated…

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same…

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour…

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed…

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.