Vulnerabilidades

La interfaz de front-end /superdiamond/preview/{projectCode}/{module}/{type} de super-diamond-server <= 1.3.3 es vulnerable a inyección SQL. El parámetro module se concatena directamente en la cláusula SQL IN mediante StringUtils.split() y concatenación de cadenas sin parametrizarse ni vincularse.

El servicio de distribución de configuración Netty (puerto 8283) de super-diamond-server <= 1.3.3 no tiene ningún mecanismo de autenticación. Los atacantes pueden obtener directamente la configuración completa de cualquier proyecto (incluidas contraseñas de bases de datos, claves de API, etc.) enviando una solicitud…

Static Web Server (SWS) es un servidor web listo para producción adecuado para archivos o recursos web estáticos. Hasta la 2.43.0, las instancias con las funciones basic-auth y metrics habilitadas procesan el endpoint /metrics antes de la comprobación de basic-auth en src/handler.rs, lo que permite a un atacante…

Stalwart Mail Server no compara un destino de redirección de OAuth con ningún destino registrado en su configuración predeterminada. La rutina de validación de crates/http/src/auth/oauth/registration.rs devuelve éxito inmediatamente cuando el requisito de autenticación del cliente está deshabilitado, y ese requisito…

Un actor malicioso con acceso a la red y privilegios elevados podría explotar una vulnerabilidad de validación de entrada incorrecta presente en UniFi OS Server para ejecutar una inyección de comandos en el dispositivo anfitrión.

Nextcloud MCP Server es un servidor MCP listo para producción que conecta asistentes de IA a una instancia de Nextcloud. Antes de la 0.117.2, el endpoint POST /webhooks/nextcloud en nextcloud_mcp_server/vector/webhook_receiver.py no tiene autenticación por defecto, porque WEBHOOK_SECRET tiene como valor predeterminado…

Hi.Events valida el destino de un webhook solo cuando se registra, nunca cuando se utiliza. NoInternalUrlRule en backend/app/Validators/Rules/NoInternalUrlRule.php resuelve el nombre de host con gethostbyname() y rechaza los rangos privados y reservados, algo que supera cualquier nombre de host público. En el envío,…

NewSiteServer (NSS), desarrollado por CyberTutor, tiene una vulnerabilidad de ausencia de autenticación. Los atacantes remotos no autenticados pueden explotar una funcionalidad específica para enviar correos electrónicos a cualquier persona en nombre del centro educativo.

NewSiteServer (NSS), desarrollado por CyberTutor, tiene una vulnerabilidad de carga arbitraria de archivos. Los atacantes remotos no autenticados pueden subir archivos arbitrarios, incluidos archivos HTML maliciosos, logrando así efectos similares a los de las secuencias de comandos en sitios cruzados (XSS).

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token dispatches on the grant_type in…

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip…

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has…

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be…

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child…

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and Server. This Stored XSS,…

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Portable Clusterware. Successful attacks of this…

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can…

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the…

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the…

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having Authenticated User privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability is in RDBMS,…