CVE-2017-6087

Improper authorization in the SocketIO interface leads to remote code execution. The vulnerability allows an attacker to execute arbitrary code on the server.

The '/password/guardarClau/recover' endpoint accepts the 'usuariId' parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts.

Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended server. A pre_shared_key extension in the ServerHello that the client never offered causes the client to complete the handshake without validating the server's certificate. The attacker needs no certificate, private key, or prior session.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded. The XS backend rejects the same label, causing inconsistency between installations.

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. No label length limit exists in the to-Unicode direction, allowing memory growth.

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. Some digit writes and the terminating NUL write do not check for room, leading to out-of-bounds writes.

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input. Unauthenticated attackers can inject a PHP Object, but the vulnerability has no impact unless another plugin or theme containing a POP chain is installed. Exploitation requires the "Allow Multiple Recipients" option to be enabled and the eCard "Custom Message" option to be disabled (the plugin default).

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: populate_via_query_string() unconditionally overrides the form's target object_id without authorization checks, and Form::process() lacks the user_can_edit() check, allowing unauthenticated attackers to overwrite any page's post_content with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then trusts the 'role' and 'auto_login' shortcode attributes in the injected [mb_user_profile_register] shortcode without role validation. The standalone plugins Meta Box Frontend Submission (up to 4.5.6) and Meta Box User Profile (up to 3.11.0) are also affected.

A vulnerability was detected in Gigatech PDV5701 version 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of the WebSocket Service component, resulting in missing authentication. The attack can be launched remotely, and the exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.