Vulnerabilidades

*** Pendiente de traducción *** A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of the component Default Local Worker Backend. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The issue was closed with the comment (translated from Chinese): "The project will be refactored and shut down."

*** Pendiente de traducción *** A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

*** Pendiente de traducción *** PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an attacker who influences a crawl target can redirect a public URL to loopback, private network, or cloud metadata services while ALLOW_LOCAL_CRAWL remains disabled. The fetched internal response is returned to the agent context. This issue is fixed in version 1.6.58.

*** Pendiente de traducción *** A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue. It is advisable to upgrade the affected component.

*** Pendiente de traducción *** A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

*** Pendiente de traducción *** A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.1.0 will fix this issue. You should upgrade the affected component.

*** Pendiente de traducción *** A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the component OIDC Service. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. Upgrading to version 3.1.0 is sufficient to resolve this issue. Upgrading the affected component is advised.

*** Pendiente de traducción *** Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-guess identifier.

*** Pendiente de traducción *** Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO

*** Pendiente de traducción *** Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty<br /> ciphertext can report success without verifying the supplied authentication<br /> tag when the operation is finalized by calling the EVP_Cipher() function.<br /> <br /> Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and<br /> expecting the call to check the AEAD tag may accept forged messages.<br /> <br /> CWE: CWE-354 (Improper Validation of Integrity Check Value)<br /> <br /> Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one<br /> shot encryption and decryption call. It also verifies the AEAD tag after the<br /> decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers<br /> it skipped the AEAD tag verification when an empty ciphertext was passed to<br /> the function. The callers of this function might believe that a successful<br /> return indicates a valid AEAD tag for these ciphers, even when that has not<br /> truly been validated in this case.<br /> <br /> FIPS impact: no<br /> The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE<br /> as the affected algorithms are not FIPS approved and thus not implemented<br /> in the FIPS module.

*** Pendiente de traducción *** Issue summary: OpenSSL CMP response validation passed an unexpected response<br /> sender distinguished name directly as the format string to `ERR_raise_data()`.<br /> <br /> Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client<br /> that enforces an expected sender or uses a pinned server certificate whose<br /> subject becomes the default expected sender.<br /> <br /> CWE: CWE-134 (Use of Externally-Controlled Format String)<br /> <br /> Description: When validating a received CMP message, ossl_cmp_msg_check_update()<br /> converts the peer-supplied sender distinguished name with X509_NAME_oneline()<br /> and passes it directly as the format argument to ERR_raise_data(). Percent<br /> characters survive the conversion, so a sender DN such as "CN=%s%n" reaches<br /> BIO_vsnprintf() as an attacker-controlled format string with no matching variadic<br /> arguments. This path is only reached when the caller configures an expected<br /> sender or pins a server certificate, which is the normal configuration for a<br /> CMP client validating server responses.<br /> <br /> Since the attacker controls the format string but none of the variadic<br /> arguments, such specifiers as %s and %n dereference or write through unrelated<br /> stack contents and crash the client. The reliable consequence is a denial of<br /> service, when the response comes from a malicious or intercepted CMP endpoint.<br /> There is no controlled memory write, arbitrary-address read, or reliable path<br /> to remote code execution.<br /> <br /> FIPS impact: no<br /> <br /> No FIPS modules are affected by this issue, as the CMP protocol<br /> implementation is outside the OpenSSL FIPS module boundary.

*** Pendiente de traducción *** Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based<br /> on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive<br /> can write and cleanse more bytes than that query reports, causing an 8-byte<br /> out-of-bounds heap write.<br /> <br /> Impact summary: An attacker who supplies a crafted CMS message can trigger a<br /> deterministic 8-byte out-of-bounds heap write when the victim decrypts it<br /> with CMS_decrypt(), corrupting the heap and typically resulting in a Denial<br /> of Service.<br /> <br /> CWE: CWE-787: Out-of-bounds Write<br /> <br /> Description: The key-wrap OID is potentially attacker-controlled on the wire.<br /> CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.<br /> An attacker can take a legitimate message and change a single OID byte to<br /> select the padded variant while leaving the message otherwise valid. Since<br /> the unwrap key is derived from the recipient&amp;#39;s private operation (ECDH key<br /> agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot<br /> pass, and the decryption fails with integrity failure.<br /> <br /> The write is a fixed-size (8-byte), fixed-value (zero) heap overflow<br /> immediately past the allocation, requires no special configuration, and is<br /> reachable from the public CMS_decrypt() function. The consequence is<br /> a heap corruption leading to a Denial of Service. The fix in the CMS code<br /> sizes the unwrap output buffer for the worst case so a failed unwrap cannot<br /> write past the allocation.<br /> <br /> FIPS impact: no<br /> <br /> As the CMS code lives outside the FIPS module boundary, no FIPS<br /> modules are affected by this CVE.