Vulnerabilidades

*** Pendiente de traducción *** A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

*** Pendiente de traducción *** A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component Data Dashboard. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

*** Pendiente de traducción *** ### Summary<br /> <br /> <br /> <br /> `qs.stringify` throws `TypeError` when called with `arrayFormat: &amp;#39;comma&amp;#39;` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs&amp;#39;s null-related options (`skipNulls`, `strictNullHandling`).<br /> <br /> <br /> <br /> ### Details<br /> <br /> <br /> <br /> In the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:<br /> <br /> <br /> <br /> ```js<br /> <br /> <br /> <br /> obj = utils.maybeMap(obj, encoder);<br /> <br /> <br /> <br /> ```<br /> <br /> <br /> <br /> `utils.encode` (`lib/utils.js:195`) reads `str.length` with no null guard, so a `null` or `undefined` element throws `TypeError`. `skipNulls` and `strictNullHandling` are both checked in the per-element loop below this line and never get a chance to run.<br /> <br /> <br /> <br /> Same class of bug as the filter-array path fixed in 0c180a4. The vulnerable shape of the comma + `encodeValuesOnly` branch was introduced in 4c4b23d ("encode comma values more consistently", PR #463, 2023-01-19), first released in v6.11.1.<br /> <br /> <br /> <br /> #### PoC<br /> <br /> <br /> <br /> ```js<br /> <br /> <br /> <br /> const qs = require(&amp;#39;qs&amp;#39;);<br /> <br /> <br /> <br /> qs.stringify({ a: [null, &amp;#39;b&amp;#39;] }, { arrayFormat: &amp;#39;comma&amp;#39;, encodeValuesOnly: true });<br /> <br /> <br /> <br /> qs.stringify({ a: [undefined, &amp;#39;b&amp;#39;] }, { arrayFormat: &amp;#39;comma&amp;#39;, encodeValuesOnly: true });<br /> <br /> <br /> <br /> qs.stringify({ a: [null] }, { arrayFormat: &amp;#39;comma&amp;#39;, encodeValuesOnly: true });<br /> <br /> <br /> <br /> // TypeError: Cannot read properties of null (reading &amp;#39;length&amp;#39;)<br /> <br /> <br /> <br /> // at encode (lib/utils.js:195:13)<br /> <br /> <br /> <br /> // at Object.maybeMap (lib/utils.js:322:37)<br /> <br /> <br /> <br /> // at stringify (lib/stringify.js:145:25)<br /> <br /> <br /> <br /> ```<br /> <br /> <br /> <br /> #### Fix<br /> <br /> <br /> <br /> `lib/stringify.js:145`, applied in 21f80b3 on `main` and released as v6.15.2:<br /> <br /> <br /> <br /> ```diff<br /> <br /> <br /> <br /> - obj = utils.maybeMap(obj, encoder);<br /> <br /> <br /> <br /> + obj = utils.maybeMap(obj, function (v) {<br /> <br /> <br /> <br /> + return v == null ? v : encoder(v);<br /> <br /> <br /> <br /> + });<br /> <br /> <br /> <br /> ```<br /> <br /> <br /> <br /> `null` and `undefined` now pass through `maybeMap` unchanged and reach the `join(&amp;#39;,&amp;#39;)` step as-is. For `{ a: [null, &amp;#39;b&amp;#39;] }` this produces `a=,b`, matching the non-`encodeValuesOnly` comma path (which already joins before encoding and produces `a=%2Cb` for the same input). Single-element `[null]` arrays still collapse via the existing `obj.join(&amp;#39;,&amp;#39;) || null` and remain subject to `skipNulls` / `strictNullHandling` in the main loop.<br /> <br /> <br /> <br /> ### Affected versions<br /> <br /> <br /> <br /> `&gt;=6.11.1

*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

*** Pendiente de traducción *** Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.

*** Pendiente de traducción *** WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the file parameter. Attackers can send requests to the duplicator_download action via admin-ajax.php with path traversal sequences to access sensitive system files outside the intended directory.

*** Pendiente de traducción *** WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.

*** Pendiente de traducción *** TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.

*** Pendiente de traducción *** Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the &amp;#39;col&amp;#39; parameter in the Activity Log interface. Attackers can send requests to the logs endpoint with malicious SQL payloads in the &amp;#39;col&amp;#39; parameter to extract database information based on response time delays.

*** Pendiente de traducción *** Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to execute arbitrary JavaScript in victim browsers when the form is submitted.

*** Pendiente de traducción *** ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without authentication.

*** Pendiente de traducción *** Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350,000 repeated characters and paste it twice into a new note to cause the application to stop responding.