Vulnerabilidades

El Tarkov Data Manager es una herramienta para gestionar los datos de ítems de Tarkov. Antes del 02 de enero de 2025, una vulnerabilidad de Cross Site Scripting (XSS) reflejado en el sistema de notificaciones 'toast' permite a cualquier atacante ejecutar JavaScript arbitrario en el contexto de la sesión del navegador…

El Tarkov Data Manager es una herramienta para gestionar los datos de los ítems de Tarkov. Antes del 02 de enero de 2025, una vulnerabilidad de omisión de autenticación en el endpoint de inicio de sesión permite a cualquier usuario no autenticado obtener acceso de administrador completo al panel de administración del…

Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.This issue affects MediaWiki - VisualData Extension: 1.45.

Se encontró una vulnerabilidad en el núcleo del servidor HTTP Undertow, que se utiliza en WildFly, JBoss EAP y otras aplicaciones Java. La biblioteca Undertow no valida correctamente el encabezado Host en las solicitudes HTTP entrantes. Como resultado, las solicitudes que contienen encabezados Host malformados o…

Salto de ruta: La vulnerabilidad '... / ...//' en SigmaPlugin Advanced Database Cleaner PRO permite el salto de ruta. Este problema afecta a Advanced Database Cleaner PRO: desde n/a hasta 3.2.10.

Cliente Forcepoint One DLP, versión 23.04.5642 (y posiblemente versiones más recientes), incluye una versión restringida de Python 2.5.4 que impide el uso de la biblioteca ctypes. ctypes es una interfaz de función externa (FFI) para Python, lo que permite llamadas a DLLs/bibliotecas compartidas, asignación de memoria…

An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following versions: Hyper Data Protector 2.2.4.1 and later

JM-DATA ONU JF511-TV versión 1.0.67 es vulnerable a ataques de falsificación de petición en sitios cruzados (CSRF), permitiendo a los atacantes realizar acciones administrativas en nombre de usuarios autenticados sin su conocimiento o consentimiento.

JM-DATA ONU JF511-TV version 1.0.67 usa credenciales predeterminadas que permiten a los atacantes obtener acceso no autorizado al dispositivo con privilegios administrativos.

JM-DATA ONU JF511-TV versión 1.0.67 es vulnerable a ataques de cross-site scripting (XSS) almacenado autenticado, lo que permite a los atacantes con acceso autenticado inyectar scripts maliciosos que se ejecutarán en los navegadores de otros usuarios cuando visualicen el contenido afectado.

NSF Unidata NetCDF-C Attribute Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a…

NSF Unidata NetCDF-C Dimension Name Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a…

NSF Unidata NetCDF-C Variable Name Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a…

NSF Unidata NetCDF-C NC Variable Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or…

NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious…

Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.

Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser.

Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information and log into the system as any user.

Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten WP Microdata wp-microdata allows Stored XSS.This issue affects WP Microdata: from n/a through <= 1.0.

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the databases present on the workstation. Prior to version 1.1.2, in certain conditions (database write access must first be obtained through another vulnerability or misconfiguration), user-controlled…

A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads Generation Module. Executing manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.

Vulnerabilidad de carga irrestricta de archivo con tipo peligroso en RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet y Base de Datos rtwwcfp-wordpress-contact-form-7-pdf permite el uso de archivos maliciosos. Este problema afecta a WordPress Contact Form 7 PDF, Google Sheet y Base de Datos: desde n/a hasta…

Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework anteriores a las versiones 10.2.0.4, incluyendo 9.3.0.x y 8.3.x muestran el rastreo completo de la pila del servidor al encontrar un error dentro del servlet GetCdfResource.

Las versiones del plugin Pentaho Data Integration and Analytics Community Dashboard Editor anteriores a 10.2.0.4, incluyendo 9.3.0.x y 8.3.x, deserializan datos JSON no confiables sin restringir el analizador a clases y métodos aprobados.