Vulnerabilidades

Mediante el suministro de nombres de usuario, SolaX Cloud sugerirá cuentas de usuario (similares) y, de este modo, filtrará información sensible como direcciones de correo electrónico de los usuarios y números de teléfono.

The AI ChatBot for WordPress WordPress plugin before 7.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any configured IdP,…

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings' action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters for organization…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows Stored XSS.This issue affects Search Cloud One: from n/a through <= 2.2.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in givecloud Donation Forms WP by Givecloud donation-forms-by-givecloud allows Stored XSS.This issue affects Donation Forms WP by Givecloud: from n/a through <= 1.0.9.

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives,…

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform…

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from s1.09.03 before v1.11.01.

Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from s1.09.01 before v1.11.01.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft OctoCloud allows Cross-Site Scripting (XSS). This issue affects OctoCloud: from s1.09.01 before v1.11.01.

La vulnerabilidad de elusión de autorización a través de clave controlada por el usuario en Akinsoft OctoCloud permite la exposición de fuga de recursos. Este problema afecta a OctoCloud: desde s1.09.02 antes de v1.11.01.

SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. In versions 4 to 5.3.0, a command injection vulnerability was discovered in the SonarQube Scan GitHub Action that allows untrusted input arguments to be processed without proper sanitization. Arguments sent to…

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Escalada de privilegios local debido a permisos de carpeta inseguros. Los siguientes productos están afectados: Acronis Cyber Protect Cloud Agent (Windows) anterior a la compilación 40734.

IBM Watson Studio en Cloud Pak for Data 4.0 y 5.0 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite a un usuario autenticado incrustar código JavaScript arbitrario en la interfaz de usuario web, alterando así la funcionalidad prevista, lo que podría llevar a la divulgación de credenciales dentro de una…

Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.

Validación de contraseña del lado del cliente (CWE-602) en lumasoft fotoShare Cloud 2025-03-13 que permite a atacantes no autenticados ver álbumes de fotos protegidos con contraseña.

Se encontró una vulnerabilidad en kalcaddle kodbox 1.61. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /?explorer/upload/serverDownload del componente "Descargar desde el controlador de enlaces". La manipulación del argumento URL provoca Server-Side Request Forgery. El ataque puede ejecutarse…

Una vulnerabilidad de Path Traversal en el proceso de instalación de paquetes NPM de Google Cloud Dataform permite a un atacante remoto leer y escribir archivos en los repositorios de otros clientes a través de un archivo package.json manipulado con fines malintencionados.

Vulnerabilidad de asignación incorrecta de privilegios en quantumcloud Simple Business Directory Pro permite la escalada de privilegios. Este problema afecta a Simple Business Directory Pro: de n/d a n/d.

Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en quantumcloud Simple Link Directory permite XSS reflejado. Este problema afecta a Simple Link Directory desde de n/d a n/d.