Vulnerabilidades

*** Pendiente de traducción *** IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files.

*** Pendiente de traducción *** IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate potentially allowing connections to an attacker-controlled server.

*** Pendiente de traducción *** IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sent to port 514 (UDP/TCP) without authentication.

*** Pendiente de traducción *** Issue summary: A malicious TLS server can cause a memory leak in a TLS<br /> client that has enabled OCSP response checking by sending an OCSP<br /> response that contains no single response entries.<br /> <br /> Impact summary: An attacker can leak an attacker-tunable amount of memory<br /> per TLS handshake in a victim client application. A long-running client<br /> that repeatedly connects to a malicious server can have its memory<br /> exhausted, resulting in a Denial of Service.<br /> <br /> CWE: CWE-401: Missing Release of Memory after Effective Lifetime<br /> <br /> Description: The affected function is called during X.509 certificate<br /> chain verification when OCSP response checking is enabled<br /> with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL<br /> verification flags, for example when a TLS client verifies an OCSP<br /> response stapled into the TLS handshake by the server.<br /> <br /> When the received BasicOCSPResponse contains an empty SEQUENCE OF<br /> SingleResponse, which is permitted on the wire and accepted by the<br /> OpenSSL decoder, the OCSP_BASICRESP structure allocated by<br /> OCSP_response_get1_basic() was not freed because an early return<br /> bypassed the cleanup code at the end of the function.<br /> <br /> The amount of memory leaked per handshake can be amplified by the<br /> attacker by padding the certs field of the BasicOCSPResponse with<br /> bogus certificates, which are parsed and stored in the leaked<br /> structure before the empty response check triggers the early return.<br /> A long-running TLS client that repeatedly connects to a malicious<br /> server can have its memory exhausted over time.<br /> <br /> OCSP response checking is not enabled by default. Only client<br /> applications that explicitly enable the OCSP response check<br /> verification flags are affected.<br /> <br /> FIPS impact: no<br /> <br /> The FIPS modules in 4.0 and 3.6 are not affected by this issue as the<br /> affected code is outside the OpenSSL FIPS module boundary.

*** Pendiente de traducción *** Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

*** Pendiente de traducción *** A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

*** Pendiente de traducción *** A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

*** Pendiente de traducción *** A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

*** Pendiente de traducción *** A flaw was found in Keycloak&amp;#39;s Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see.

*** Pendiente de traducción *** Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application&amp;#39;s data folder with elevated integrity.

*** Pendiente de traducción *** The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback =&gt; &amp;#39;__return_true&amp;#39;` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin&amp;#39;s banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.

*** Pendiente de traducción *** The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin&amp;#39;s six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion `ajax_connect()` handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.