Vulnerabilidades

*** Pendiente de traducción *** A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version

*** Pendiente de traducción *** An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

*** Pendiente de traducción *** OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS#11 TA. Version 4.11.0 contains a patch. No known workarounds are available.

*** Pendiente de traducción *** The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

*** Pendiente de traducción *** ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

*** Pendiente de traducción *** BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

*** Pendiente de traducción *** A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts with specific permissions.

*** Pendiente de traducción *** OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.21.0 and prior to version 4.11.0, the ARM Crypto Extensions accelerated SHA-3 implementation has an off-by-one error that can cause a massive heap overflow that corrupts all TEE kernel memory following the hash state. This affects all platforms built with `CFG_CRYPTO_WITH_CE82=y` (ARMv8.2+ with SHA3 Crypto Extensions). Version 4.11.0 contains a patch. As a workaround, disable SHA3 Crypto Extensions with `CFG_CRYPTO_WITH_CE82=n`.

*** Pendiente de traducción *** Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel<br /> <br /> Versions Affected:<br />   before 3.0.0-M4 (libsvm document categorization module; introduced in<br />   OPENNLP-1808 and only present on the 3.x line)<br /> <br /> Description:<br /> SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled<br /> stream with java.io.ObjectInputStream and calls readObject() without an<br /> ObjectInputFilter installed. ObjectInputStream materialises every class<br /> referenced in the stream before the resulting object is cast to<br /> SvmDoccatModel, so the cast that follows readObject() executes only<br /> after the foreign object graph has already been deserialised in full.<br /> <br /> If a Java deserialization gadget chain is available on the consumer&amp;#39;s<br /> classpath, a crafted payload supplied to<br /> deserialize() executes arbitrary code in the JVM that loads it. Apache<br /> OpenNLP itself does not ship a known gadget chain, so the realistic<br /> risk is to downstream applications that embed the libsvm module<br /> alongside vulnerable transitive dependencies. The method is public and<br /> static, so any caller can pass an untrusted stream to it directly.<br /> <br /> The practical impact is remote code execution against processes that<br /> load SvmDoccatModel instances from untrusted or semi-trusted origins.<br /> <br /> Mitigation:<br /> <br /> 3.x users should upgrade to 3.0.0-M4.<br /> <br /> Users who cannot upgrade immediately should treat all serialized<br /> SvmDoccatModel streams as untrusted input unless their provenance is<br /> verified, and should avoid invoking SvmDoccatModel.deserialize() on<br /> streams supplied by end users or fetched from third-party sources<br /> without integrity checks.

*** Pendiente de traducción *** A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled

*** Pendiente de traducción *** A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

*** Pendiente de traducción *** DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade DrawIO for ownCloud 10 to version 1.0.2 or later to receive a patch.