CSRF vulnerability and missing permission check in docker-build-step

docker-build-step 2.11 and earlier does not perform a permission check in an HTTP endpoint implementing a connection test. This allows attackers with Overall/Read permission to connect to an attacker-specified TCP or Unix socket URL. Additionally, the plugin reconfigures itself using the provided...

Liferay Portal 6.1.0 'addUser()' Security Bypass

The version of Liferay Portal hosted on the remote web server contains a flaw in the 'UserServiceUtil' class's 'addUser' method that allows a remote, unauthenticated attacker to create new administrative users. Since administrative users can install new plugins and extensions, this may lead to...