Liferay Portal and Liferay DXP Security Vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

CVE-2024-26269: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML...

@openwebrx-js/cli (>=0.1.0, <=0.1.7), @surroundify/server (>=2.13.0, <=2.14.1) +5 more potentially affected by CVE-2024-21522 via audify (1.10.1)

audify NPM version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on audify and may be impacted: - @openwebrx-js/cli =0.1.0, =2.13.0, =0.1.0, =0.4.0, =0.5.2 Source cves: CVE-2024-21522 Source advisory: SNYK:JS-AUDIFY-6370700...

UBUNTU-CVE-2024-21896

The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from to obtain a Buffer from the result of path.resolve. By monkey-patching Buffer internals, namely...

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

...

SUSE CVE-2024-21896

The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from to obtain a Buffer from the result of path.resolve. By monkey-patching Buffer internals, namely...

UBUNTU-CVE-2023-42282

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via isPublic...

Network Utilies for Node.js Command Injection Vulnerability

Network Utilies for Node.js is an application by Tomás Pollak, an individual developer. A command injection vulnerability exists in Network Utilies for Node.js prior to version 0.7.0, which stems from the use of the childprocess exec function without input cleanup, and could be exploited by an...

Malicious code in discord.js-sounds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fdfa47c01e5a71fae385f0e33ccdecc9e8af079d01f3f8e400032bfb6a524b6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shenmue-dmall.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b6cf3e11f9ca2808a4c1a8a8dfa76b54c0aa44588685c9079ae9b9e39837bc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-27168

An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp file...

Malicious code in discord.js-v12selfbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 185d6410de1e975280bd6d535f7905cd9264eacb3c2ff98813e61d1a4ae0e2b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-6645: Improper Neutralization of Input During Web Page Generation

The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

CVE-2023-52216

Cross-Site Request Forgery CSRF vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3...

CVE-2023-52216

Cross-Site Request Forgery CSRF vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3...

CVE-2023-52216 WordPress JS & CSS Script Optimizer Plugin <= 0.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3...

CVE-2023-52216

CVE-2023-52216 concerns the WordPress plugin JS & CSS Script Optimizer . Public sources in the connected set confirm a CSRF vulnerability affecting versions up to and including 0.3.3, with unauthenticated attackers able to coerce an authenticated site administrator to perform a forged action. The...

PT-2024-14480 · Unknown · Js & Css Script Optimizer

Name of the Vulnerable Software and Affected Versions: JS & CSS Script Optimizer versions 0.3.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the JS & CSS Script Optimizer. This type of issue allows an attacker to trick a user into performing unintended actions on a web...

CVE-2023-52216: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Yevhen Kotelnytskyi JS & CSS Script Optimizer.This issue affects JS & CSS Script Optimizer: from n/a through 0.3.3...