Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2020-36663

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to 0.17.1. This affects the function makeTag of the file OpenGraph.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The patch is named ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222231.

Gravedad CVSS v3.1: MEDIA

Última modificación:

17/05/2024

CVE-2023-26481

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin (or sent via email by an admin) can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an Identification and an Email stage bound to it. If the flow has policies on the identification stage to skip it when the flow is restored (by checking `request.context[&#39;is_restored&#39;]`), the flow is not affected by this. With this flow in place, an administrator must create a recovery Link or send a recovery URL to the attacker, who can, due to the improper validation of the token create, set the password for any account. Regardless, for custom recovery flows it is recommended to add a policy that checks if the flow is restored, and skips the identification stage. This issue has been fixed in versions 2023.2.3, 2023.1.3 and 2022.12.2.<br />

Gravedad CVSS v3.1: MEDIA

Última modificación:

07/11/2023

CVE-2023-25819

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-passed` version of Discourse.

Gravedad CVSS v3.1: MEDIA

Última modificación:

09/03/2023

CVE-2021-36689

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decrypt data via a brute force attack that uses a recovered samourai.dat file. The PIN is 5 to 8 digits, which may be insufficient in this situation.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/03/2023

CVE-2023-23929

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Currently, the refresh token is valid indefinitely. The refresh token should get a validity of 24-48 hours. A fix was released in version 3.8.0.<br />

Gravedad CVSS v3.1: ALTA

Última modificación:

07/11/2023

CVE-2023-26486

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argument group to getScale, which is then used as if it were an internal context. The context.scales[name].value is accessed from group and called as a function back in scale. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript. This issue has been fixed in version 5.13.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

09/03/2023

CVE-2023-26487

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.`lassoAppend&#39; function accepts 3 arguments and internally invokes `push` function on the 1st argument specifying array consisting of 2nd and 3rd arguments as `push` call argument. The type of the 1st argument is supposed to be an array, but it&#39;s not enforced. This makes it possible to specify any object with a `push` function as the 1st argument, `push` function can be set to any function that can be access via `event.view` (no all such functions can be exploited due to invalid context or signature, but some can, e.g. `console.log`). The issue is that`lassoAppend` doesn&#39;t enforce proper types of its arguments. This issue opens various XSS vectors, but exact impact and severity depends on the environment (e.g. Core JS `setImmediate` polyfill basically allows `eval`-like functionality). This issue was patched in 5.23.0.<br />

Gravedad CVSS v3.1: MEDIA

Última modificación:

07/11/2023

CVE-2023-26490

Fecha de publicación:

04/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to obtain shell access to the Docker container running dovecot. The imapsync Perl script implements all the necessary functionality for this feature, including the XOAUTH2 authentication mechanism. This code path creates a shell command to call openssl. However, since different parts of the specified user password are included without any validation, one can simply execute additional shell commands. Notably, the default ACL for a newly-created mailcow account does not include the necessary permission. The Issue has been fixed within the 2023-03 Update (March 3rd 2023). As a temporary workaround the Syncjob ACL can be removed from all mailbox users, preventing from creating or changing existing Syncjobs.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/03/2023

CVE-2023-25402

Fecha de publicación:

03/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. There is no restriction on the suffix of the uploaded file, resulting in any file upload.

Gravedad CVSS v3.1: ALTA

Última modificación:

06/03/2025

CVE-2023-25403

Fecha de publicación:

03/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username to bypass authentication.

Gravedad CVSS v3.1: ALTA

Última modificación:

07/03/2025

CVE-2023-26047

Fecha de publicación:

03/03/2023

Idioma:

Inglés

*** Pendiente de traducción *** teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim&#39;s browser and compromise the security of the web application. An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim&#39;s browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim&#39;s browser and perform malicious actions. This issue has been patched in version 0.2.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/03/2023