Vulnerabilidades

*** Pendiente de traducción *** Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory corruption and the httpd process to crash, resulting in a denial of service for the web administration service.

*** Pendiente de traducción *** In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.

*** Pendiente de traducción *** Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.

*** Pendiente de traducción *** The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), enabling file access with the privilege level of ZTE File Manager. This allows unrooted devices to read files under certain system directories such as /data/data and /data/local/tmp. If access restrictions do not block untrusted applications, additional directories may also be accessible.

*** Pendiente de traducción *** A flaw was found in the kernel. An unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.

*** Pendiente de traducción *** Rejected reason: duplicate

*** Pendiente de traducción *** cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be allocated based on an underestimated length. When cJSON_PrintBuffered() is used with a pre-allocated buffer, the subsequent write loop overflows the heap allocation. An attacker supplying a crafted JSON string to an application using cJSON on a 32-bit platform can cause a heap buffer overflow, potentially leading to remote code execution, information disclosure, or denial of service.<br /> <br /> <br /> <br /> <br /> Because project creator contact attempts were unsuccessful, the vulnerability has only been confirmed in version 1.7.19 but may also affect other versions.

*** Pendiente de traducción *** Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.

*** Pendiente de traducción *** Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.

*** Pendiente de traducción *** This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware.<br /> <br /> An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism.<br /> <br /> <br /> <br /> Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with elevated privileges on the targeted device.

*** Pendiente de traducción *** This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting brute-force attacks against HTTP endpoint on the targeted device.<br /> <br /> <br /> <br /> Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to live video snapshots from the targeted device.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: openvswitch: reject oversized nested action attrs<br /> <br /> Open vSwitch stores generated flow actions as nlattrs, whose nla_len<br /> field is u16. Commit a1e64addf3ff ("net: openvswitch: remove<br /> misbehaving actions length check") allowed the total sw_flow_actions<br /> stream to grow beyond 64 KiB, which is valid, but also removed the last<br /> guard preventing a generated nested action attribute from exceeding<br /> U16_MAX.<br /> <br /> An oversized generated container can thus be closed with a truncated<br /> nla_len. A later dump or teardown then walks a structurally different<br /> stream than the one that was validated. In particular, an oversized<br /> nested CLONE/CT action may cause subsequent bytes in the generated<br /> stream to be interpreted as independent actions.<br /> <br /> Keep the larger total-action-stream behavior, but make nested action<br /> close reject generated containers that do not fit in nla_len, and return<br /> the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and<br /> CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse<br /> construction order before discarding failed wrappers, so resources copied<br /> into the rejected tails are released before the wrappers are removed.<br /> <br /> Most failed outer wrappers are discarded by truncating actions_len after<br /> child resources have been released. CHECK_PKT_LEN also trims its parent<br /> after branch resources are gone. SET/TUNNEL close failures unwind their<br /> known tun_dst ownership directly, and SET_TO_MASKED has no external<br /> ownership and truncates on close failure.