Base de CVEs

CWE-306: Ausência de autenticação para função crítica no broker de telemetria e comandos ait.core.server (ait-server) no NASA-AMMOS AIT-Core até 3.1.1 permite que um atacante remoto não autenticado com acesso à rede ao barramento de mensagens ZeroMQ injete dados de comando de espaçonave, exfiltre tráfego de comandos e telemetria, injete telemetria forjada ou interrompa o barramento de comandos e telemetria. O broker ZeroMQ do ait-server vincula seus sockets XSUB e XPUB a todas as interfaces de rede por padrão, sem autenticação ou segurança de transporte. Um atacante capaz de alcançar a porta TCP 5559 pode publicar mensagens em tópicos internos, incluindo o tópico de comandos __commands__. Com a configuração padrão distribuída, mensagens de comando são encaminhadas por command_stream e emitidas pelo caminho UDP de uplink de comandos. Um atacante capaz de alcançar a porta TCP 5560 pode assinar o tráfego de comandos e telemetria no barramento de solo. O AIT-Core 3.1.2 altera os endereços de bind padrão do ZeroMQ para loopback.

No Bouncy Castle para Java anterior à versão 1.86, a implementação de Messaging Layer Security (MLS, RFC 9420) não vinculava uma credencial X.509 à signature_key de um LeafNode. O LeafNode.verify() verificava a assinatura de uma folha com a signature_key presente na própria folha, enquanto a cadeia de certificados X.509 da credencial era armazenada, mas nunca interpretada nem validada, de modo que a chave pública do certificado de entidade final nunca precisava coincidir com a signature_key, como exige a RFC 9420 sec. 5.3. Assim, uma parte podia apresentar o certificado de outra parte como sua credencial, assinando a folha e o KeyPackage que a contém com uma chave não relacionada, e ser aceita sob a identidade dessa outra parte por meio de KeyPackage.verify() e do caminho de validação de folhas do Group. Em uma implantação que admite commits externos sem uma verificação independente de admissão de credenciais, um atacante não autenticado poderia ser admitido sob a identidade X.509 de uma vítima, expulsar a vítima (a ressincronização compara credenciais inteiras e não chaves de assinatura), derivar a época atual, decifrar mensagens subsequentes do grupo e enviar mensagens aceitas como sendo da vítima. O TreeKEM.LeafNode agora exige que a chave pública do assunto do certificado de entidade final, na codificação de assinatura do conjunto de cifras, seja igual à signature_key para uma credencial X.509, e rejeita a folha caso contrário, incluindo uma cadeia vazia ou um certificado cujo tipo de chave não corresponda ao conjunto de cifras; a validação da cadeia de certificados e da identidade até uma âncora de confiança continua sendo responsabilidade da aplicação, conforme a RFC 9420 sec. 5.3.1. Implantações que usam apenas credenciais básicas não são afetadas.

O plugin The Beaver Builder Page Builder – Drag and Drop Website Builder para WordPress é vulnerável a execução arbitrária de shortcodes em todas as versões até a 2.11.0.5 inclusive. Isso se deve ao software permitir que usuários executem uma ação que não valida adequadamente um valor antes de executar do_shortcode. Isso torna possível que atacantes não autenticados executem shortcodes arbitrários. A exploração exige que o site alvo tenha uma página do Beaver Builder contendo o módulo Sidebar preenchido com um widget que exibe texto controlável pelo atacante, como o widget nativo Recent Comments, com moderação de comentários desativada ou com o comentário do atacante aprovado.

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.

No ConvertX anterior à 0.19.0, o arquivo converters/calibre.ts não bloqueia arquivos de receita e, em vez disso, os repassa ao programa ebook-convert do Calibre. Isso afeta código executável em um arquivo .recipe ou .downloaded_recipe.

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single crafted request.

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtain the key value can authenticate without a user account or JWT to create accounts, manage users, exfiltrate data, and modify security rules.

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, resulting in command execution on monitored endpoints where agent processes commonly run as root or SYSTEM.

Uma requisição HTTP POST especialmente elaborada para a interface de administração web permite que um atacante não autenticado execute comandos arbitrários do sistema operacional com privilégios de root no dispositivo afetado. Desabilite o servidor web quando não estiver configurando o dispositivo.

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might allow an authenticated remote user with project contributor permissions to execute arbitrary commands in another project member's Studio Space and obtain that member's temporary execution role credentials via a crafted connection resource property that is interpolated into a shell invocation without neutralization. To remediate this issue, users should upgrade to version 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, or 4.4.3, as applicable to the minor line in use. Users on minor lines that have reached end of support must move to a supported minor line, because no patched version will be released for those lines. In Amazon SageMaker Unified Studio, Studio Spaces adopt the latest patch of their minor line on restart once the patched images are deployed, so no version selection is required.

Falta de autenticação para função crítica no componente de dependência de autenticação do Loom for AWS antes da 1.6.1 permitiu que atores remotos obtivessem autoridade de super-administrador sobre o plano de controle de agentes, incluindo o registro de servidores de ferramentas, a leitura de credenciais de integração armazenadas e a reescrita das políticas de funções IAM associadas a funções de agentes gerenciados, por meio de qualquer requisição à API da aplicação em uma implantação na qual nenhum provedor de identidade esteja configurado. Para corrigir este problema, os usuários devem atualizar para a versão 1.6.1 ou posterior.

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token parameter to upload a malicious JSP file into a web-accessible directory and then request it to achieve remote code execution as the web-server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2.

agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.

FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.