Advisory ROSA-SA-2025-3005

software: gimp 2.10.36 WASP: ROSA-CHROME unaffected versions = gimp-2.10.36-4 affected versions gimp-2.10.36-4 CVE-ID: CVE-2025-5473 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: An integer overflow vulnerability in GIMP parsing ICO files allows remote attackers to execute arbitrary code. User interacti...

CVE-2025-58746

The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary...

CVE-2025-10233

CVE-2025-10233 affects kalcaddle kodbox 1.61, with a path traversal flaw in the functions fileGet and fileSave of app/controller/explorer/editor.class.php caused by manipulating the path argument. This enables remote exploitation and has public disclosures; vendor reportedly did not respond. A PT...

CVE-2025-10233 kalcaddle kodbox editor.class.php fileSave path traversal

A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-10233 kalcaddle kodbox editor.class.php fileSave path traversal

A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2025-10233 kalcaddle kodbox editor.class.php fileSave path traversal

A security vulnerability has been detected in kalcaddle kodbox 1.61. This affects the function fileGet/fileSave of the file app/controller/explorer/editor.class.php. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /c/portal/comment/discussion/geteditor path. An attacker can execute arbitrary web scripts in the context of a user's browser by crafting a malicious request. Details Cross-site scripting or XSS is a cod...

Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

A reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML...

GHSA-JHGR-J9CJ-8J62 Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

A reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected XSS in Liferay Portal and Liferay DXP due to insufficient input sanitization in the /c/portal/comment/discussion/get_editor endpoint. Affected: Portal 7.4.3.73–7.4.3.128 and DXP 2024.Q3.0–2024.Q3.1, 2024.Q2.0–2024.Q2.13, 2024.Q1.1–2024.Q1.12, and 7.4 update 73–92. Impact: remote attacke...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-9367

CVE-2025-9367 affects the Welcart e-Commerce plugin for WordPress (versions up to 2.11.20). It enables stored Cross-Site Scripting via settings due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level permissions or higher can inject scripts that execu...

UPDF 代码问题漏洞

UPDF is a multi-platform PDF editor from the Chinese company UPDF. A code issue vulnerability exists in UPDF version 1.8.5.0, which stems from DLL search path hijacking and could lead to the execution of arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2019-11201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor al...

kodbox 路径遍历漏洞

kodbox is a web file manager by the individual developer warlee. A path traversal vulnerability exists in kodbox version 1.61, which is caused by the incorrect operation of the fileGet/fileSave function on the path parameter in the file app/controller/explorer/editor.class.php...

Linux Distros Unpatched Vulnerability : CVE-2012-5867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability CVE-2012-5867 Note that Nessus relies on the presence of the package as reported by the vendor...

UPDF 代码问题漏洞

UPDF is a multi-platform PDF editor from the Chinese company UPDF. A code issue vulnerability exists in UPDF version 1.8.5.0, which stems from DLL search path hijacking and could lead to the execution of arbitrary code...