Vulnerabilidades

*** Pendiente de traducción *** A flaw has been found in Open5GS up to 2.7.6. This impacts the function ogs_sbi_nf_instance_set_id in the library /lib/sbi/context.c of the component NRF. Executing a manipulation of the argument nfInstanceId can lead to denial of service. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

*** Pendiente de traducción *** A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function ogs_sbi_client_add in the library /lib/sbi/client.c of the component NRF. The manipulation of the argument client_pool leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

*** Pendiente de traducción *** A vulnerability was found in Investintech SlimPDFReader up to 2.0.13. Affected by this vulnerability is the function sub_3B4610 of the file SlimPDFReader.exe. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor responded to the initial vulnerability report by the researcher with a note that the product is discontinued. This vulnerability only affects products that are no longer supported by the maintainer.

*** Pendiente de traducción *** A security vulnerability has been detected in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_discovery_option_parse_plmn_list in the library /lib/sbi/conv.c of the component NRF. Such manipulation of the argument target-plmn-list leads to denial of service. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

*** Pendiente de traducción *** The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.

*** Pendiente de traducción *** A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component Data Dashboard. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

*** Pendiente de traducción *** A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

*** Pendiente de traducción *** ### Summary<br /> <br /> <br /> <br /> `qs.stringify` throws `TypeError` when called with `arrayFormat: &amp;#39;comma&amp;#39;` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs&amp;#39;s null-related options (`skipNulls`, `strictNullHandling`).<br /> <br /> <br /> <br /> ### Details<br /> <br /> <br /> <br /> In the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:<br /> <br /> <br /> <br /> ```js<br /> <br /> <br /> <br /> obj = utils.maybeMap(obj, encoder);<br /> <br /> <br /> <br /> ```<br /> <br /> <br /> <br /> `utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.<br /> <br /> <br /> <br /> Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d ("encode comma values more consistently", PR #463, 2023-01-19), first released in v6.11.1.<br /> <br /> <br /> <br /> #### PoC<br /> <br /> <br /> <br /> ```js<br /> <br /> <br /> <br /> const qs = require(&amp;#39;qs&amp;#39;);<br /> <br /> <br /> <br /> qs.stringify({ a: [null, &amp;#39;b&amp;#39;] }, { arrayFormat: &amp;#39;comma&amp;#39;, encodeValuesOnly: true });<br /> <br /> <br /> <br /> qs.stringify({ a: [undefined, &amp;#39;b&amp;#39;] }, { arrayFormat: &amp;#39;comma&amp;#39;, encodeValuesOnly: true });<br /> <br /> <br /> <br /> qs.stringify({ a: [null] }, { arrayFormat: &amp;#39;comma&amp;#39;, encodeValuesOnly: true });<br /> <br /> <br /> <br /> // TypeError: Cannot read properties of null (reading &amp;#39;length&amp;#39;)<br /> <br /> <br /> <br /> // at encode (lib/utils.js:195:13)<br /> <br /> <br /> <br /> // at Object.maybeMap (lib/utils.js:322:37)<br /> <br /> <br /> <br /> // at stringify (lib/stringify.js:145:25)<br /> <br /> <br /> <br /> ```<br /> <br /> <br /> <br /> #### Fix<br /> <br /> <br /> <br /> `lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:<br /> <br /> <br /> <br /> ```diff<br /> <br /> <br /> <br /> - obj = utils.maybeMap(obj, encoder);<br /> <br /> <br /> <br /> + obj = utils.maybeMap(obj, function (v) {<br /> <br /> <br /> <br /> + return v == null ? v : encoder(v);<br /> <br /> <br /> <br /> + });<br /> <br /> <br /> <br /> ```<br /> <br /> <br /> <br /> `null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(&amp;#39;,&amp;#39;)` step as-is. For `{ a: [null, &amp;#39;b&amp;#39;] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(&amp;#39;,&amp;#39;) || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.<br /> <br /> <br /> <br /> ### Affected versions<br /> <br /> <br /> <br /> `&gt;=6.11.1

*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

*** Pendiente de traducción *** Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

*** Pendiente de traducción *** TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.

*** Pendiente de traducción *** WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter. Attackers can send requests to the duplicator_download action via admin-ajax.php with path traversal sequences to access sensitive system files outside the intended directory.