Vulnerabilidades

Vulnerabilidad de Credenciales Insuficientemente Protegidas en Apache Fineract. Este problema afecta a Apache Fineract: hasta la versión 1.11.0. El problema está solucionado en la versión 1.12.1. Se recomienda a los usuarios actualizar a la versión 1.13.0, la última versión.

Existe una vulnerabilidad de ejecución remota de código donde un nodo Raft malicioso puede explotar la deserialización Hessian insegura dentro del almacén PD. La solución aplica autenticación basada en IP para restringir la membresía del clúster e implementa una lista blanca de clases estricta para fortalecer el…

Vulnerabilidad de Requisitos de Contraseña Débiles en Apache Fineract. Este problema afecta a Apache Fineract: hasta la versión 1.10.1. El problema está corregido en la versión 1.11.0. Se recomienda a los usuarios que actualicen a la versión 1.13.0, la última versión.

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to…

Servidor HTTP Apache 2.4.65 y anteriores con Server Side Includes (SSI) habilitado y mod_cgid (pero no mod_cgi) pasa la cadena de consulta con escape de shell a las directivas #exec cmd='...'. Este problema afecta al Servidor HTTP Apache anterior a 2.4.66. Se recomienda a los usuarios actualizar a la versión 2.4.66,…

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to…

An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before…

Vulnerabilidad de Neutralización Inadecuada de Secuencias de Escape, Meta o Control en Servidor HTTP Apache a través de variables de entorno establecidas mediante la configuración de Apache que anulan inesperadamente las variables calculadas por el servidor para programas CGI. Este problema afecta a Servidor HTTP…

Vulnerabilidad de Server-Side Request Forgery (SSRF) en el Servidor HTTP Apache en Windows con AllowEncodedSlashes On y MergeSlashes Off permite potencialmente filtrar hashes NTLM a un servidor malicioso a través de SSRF y peticiones o contenido maliciosos. Se recomienda a los usuarios actualizar a la versión 2.4.66,…

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE…

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Uncontrolled recursion in the json2pb component in Apache bRPC (version < 1.15.0) on all platforms allows remote attackers to make the server crash via sending deep recursive json data. Root Cause: The bRPC json2pb component uses rapidjson to parse json data from the network. The rapidjson parser uses a recursive…

Revela credenciales en texto plano en la vulnerabilidad del comando MONITOR en Apache Kvrocks. Este problema afecta a Apache Kvrocks: desde la versión 1.0.0 hasta la 2.13.0. Se recomienda a los usuarios actualizar a la versión 2.14.0, que soluciona el problema.

Vulnerabilidad de Gestión de Privilegios Inadecuada en Apache Kvrocks. Este problema afecta a Apache Kvrocks: desde la v2.9.0 hasta la v2.13.0. Se recomienda a los usuarios actualizar a la versión 2.14.0, que soluciona el problema.

In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally…

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins. This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0,…

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10.2.0. Users are recommended to upgrade to version 10.3.0, which fixes the issue.

Vulnerabilidad de inyección SQL en Hive Metastore Server (HMS) al procesar solicitudes de eliminación de estadísticas de columnas a través de las API T.hrift. La vulnerabilidad solo puede ser explotada por usuarios/aplicaciones de confianza/autorizados a los que se les permite llamar directamente a las API Thrift. En…

El autenticador Kerberos de Apache Druid utiliza un secreto de respaldo débil cuando la configuración `druid.auth.authenticator.kerberos.cookieSignatureSecret` no se establece explícitamente. En este caso, el secreto se genera utilizando `ThreadLocalRandom`, que no es un generador de números aleatorios…

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal…

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers,…

Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JDBC drivers,…

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application…

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. Such links could also be used to transmit system information, such as environment variables or configuration…

Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue.