CVE-2025-43803

Insecure direct object reference IDOR vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows...

CVE-2025-43803

Insecure direct object reference IDOR vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows...

CVE-2025-43803

The CVE-2025-43803 case affects Liferay Portal and Liferay DXP where the Contacts Center widget directly exposes the entryId parameter (_com_liferay_contacts_web_portlet_ContactsCenterPortlet_entryId) leading to an Insecure Direct Object Reference (IDOR). Affected versions include Liferay Portal ...

PT-2025-38612

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.119 Liferay DXP versions 2023.Q3.1 through 2023.Q3.10 Liferay DXP versions 2023.Q4.0 through 2023.Q4.6 Liferay Portal versions 7.4 GA through update 92 Description An insecure direct object reference...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

Malicious code in tml-footer (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 00452b25be1612714f1d3a1de19a9429e6d4f1d0c2450103ce3791c2d27ff72a The OpenSSF Package Analysis project identified 'tml-footer' @ 99.9.9...

CVE-2025-32346

In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48523

In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48523

In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48523

CVE-2025-48523 targets Android: the issue occurs in onCreate of SelectAccountActivity.java and allows adding contacts without the required permission due to a logic error. This enables local escalation of privilege with no additional execution privileges and without user interaction. Impact is de...

CVE-2025-48523

In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48523

In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Google Android 安全漏洞

Google Android is a free and open source mobile operating system based on the Linux kernel, developed by Google Inc. and the Open Handset Alliance, and is mainly used for smartphones, tablets and other devices. Google Android suffers from an obfuscated proxy vulnerability that originates from...

PT-2025-36050

Name of the Vulnerable Software and Affected Versions: SelectAccountActivity.java affected versions not specified Description: A logic error in the onCreate function of SelectAccountActivity.java may allow adding contacts without the necessary permissions. This could lead to local privilege...

ASB-A-388032224

In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Malicious code in react-media-template-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5a2fff48804ddfb5297954a2040eb8f90fd5ca36c31568a46d56d860ecf47148 The OpenSSF Package Analysis project identified 'react-media-template-ts' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2025-42047 Malicious code in notthis (npm)

The package communicates with a domain associated with malicious activity...

Linux Distros Unpatched Vulnerability : CVE-2018-17780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram Desktop aka tdesktop 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe...

MAL-2025-6933 Malicious code in guppy-dev (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b56a4d108a100f12dd3aedb0e1f0f3b8007ecc181e366198a22242473696f219 The OpenSSF Package Analysis project identified 'guppy-dev' @ 2.0.0 n...

Nextcloud: Stored XSS in contacts app via organisation and title field

A stored XSS vulnerability was discovered in the contacts app of the software. The vulnerability could be triggered by inputting malicious code in the organization or title field...