INCIBI-CERT antes CERTSI

INCIBE-CERT es el centro de respuesta a incidentes de seguridad de referencia para los ciudadanos y entidades de derecho privado en España operado por el Instituto Nacional de Ciberseguridad,  que depende del Ministerio de Interior.

 

  1. Gravedad: None

    Publicado: 27/11/2021

    Last revised: 27/11/2021

    Descripción: *** Pendiente de traducción *** janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  2. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.

  3. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** @joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji, and an i18n string. In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.

  4. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

  5. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

  6. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

  7. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-service. The vulnerability can be exploited remotely by an attacker. A successful attack will result in denial-of-service of the antivirus engine.

  8. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-5-104 function of Hitachi Energy RTU500 series allows an attacker to cause the receiving RTU500 CMU of which the BCI is enabled to reboot when receiving a specially crafted message. By default, BCI IEC 60870-5-104 function is disabled (not configured). This issue affects: Hitachi Energy RTU500 series CMU Firmware version 12.0.* (all versions); CMU Firmware version 12.2.* (all versions); CMU Firmware version 12.4.* (all versions).

  9. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.

  10. Gravedad: None

    Publicado: 26/11/2021

    Last revised: 26/11/2021

    Descripción: *** Pendiente de traducción *** HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)