Vulnerabilidades

*** Pendiente de traducción *** su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts.

*** Pendiente de traducción *** BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests.

*** Pendiente de traducción *** Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately.

*** Pendiente de traducción *** Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges.

*** Pendiente de traducción *** Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

*** Pendiente de traducción *** The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.

*** Pendiente de traducción *** A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Submission. The manipulation leads to race condition. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The vendor deleted the GitHub issue for this vulnerability without and explanation.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: gro: properly validate BIG TCP aggregation criteria<br /> <br /> When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),<br /> BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP<br /> (with sufficient MAC header room to insert the temporary HBH jumbo header).<br /> <br /> However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp")<br /> loosened the check in skb_gro_receive(), leading to several issues:<br /> <br /> 1. skb_gro_receive() checked skb_headroom(p) instead of the actual space<br /> before the MAC header (p-&gt;mac_header). Because skb_headroom(p) includes<br /> mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check<br /> with p-&gt;mac_header head,<br /> causing an out-of-bounds write and wrapping skb-&gt;mac_header.<br /> 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /<br /> ETH_P_8021AD) to aggregate beyond 64KB because<br /> p-&gt;protocol != ETH_P_IPV6 was true.<br /> 3. It checked p-&gt;encapsulation instead of NAPI_GRO_CB(skb)-&gt;encap_mark,<br /> allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate<br /> beyond 64KB.<br /> <br /> Fix skb_gro_receive() to strictly enforce:<br /> - NAPI_GRO_CB(skb)-&gt;proto == IPPROTO_TCP<br /> - Not encapsulated (!NAPI_GRO_CB(skb)-&gt;encap_mark &amp;&amp; !p-&gt;encapsulation)<br /> - Protocol must be either ETH_P_IP or ETH_P_IPV6<br /> - If ETH_P_IPV6, p-&gt;mac_header must be at least<br /> sizeof(struct hop_jumbo_hdr)<br /> <br /> Returning -E2BIG from skb_gro_receive() ensures that packets which cannot<br /> become BIG TCP are cleanly flushed at

*** Pendiente de traducción *** The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.

*** Pendiente de traducción *** The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users&amp;#39; order billing details, including name, email address, phone number and postal address, by enumerating order IDs.

*** Pendiente de traducción *** The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.

*** Pendiente de traducción *** The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.