GHSA-GHW5-998M-VW4W Liferay Portal and Liferay DXP fails to check origin of event messages

The Remote App module before 2.0.21 from Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

GitLab 13.0.x < 14.6.5, 14.7.x < 14.7.4, 14.8.x < 14.8.2 GraphQL API User Enumeration Vulnerability - Active Check

GitLab is prone to a user enumeration vulnerability via the GraphQL API. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

CVE-2022-25146

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

CVE-2022-25146

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

CVE-2022-25146

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

Cross site request forgery (csrf)

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

CVE-2022-25146: Origin Validation Error

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

CVE-2022-25146

The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the origin of event messages it receives matches the origin of the Remote App, allowing attackers to exfiltrate the CSRF token via a crafted event message...

CVE-2022-25146

The CVE-2022-25146 affects Liferay Portal: v7.4.3.4–v7.4.3.8 and Liferay DXP 7.4 before update 5, in the Remote App module. Root cause: the origin of event messages is not validated against the Remote App origin, allowing CSRF token exfiltration via a crafted event message. Impact: partial confid...

PT-2022-17098 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.4 through 7.4.3.8 Liferay DXP 7.4 before update 5 Description: The issue concerns the Remote App module, which fails to verify if the origin of received event messages matches the Remote App's origin. This allows...

CVE-2022-22288

CVE-2022-22288 affects Samsung Galaxy Store; vulnerability is an improper authorization flaw in Galaxy Store prior to version 4.5.36.5 that enables remote installation from the allowlist. Root cause per sources is improper authorization allowing an attacker to trigger installations without proper...

CVE-2022-22288

Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...

CVE-2022-22288: Improper Authorization

Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist...

SSL/TLS: Untrusted Certificate Detection

Checks and reports if a remote SSL/TLS service is using a certificate which is untrusted / the verification against the system wide trust store has failed. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

September 21, 2021—KB5005625 (OS Build 17763.2210) Preview

None None...

Hot Pepper Gourmet App fails to restrict access permissions

Overview Hot Pepper Gourmet App provided by Recruit Co., Ltd. implements the function to access a requested URL using Custom URL Scheme. This function contains an improper access control vulnerability CWE-284 that may allow the vulnerable App to receive an request from an arbitrary App and execut...

Vivo appstore input validation error vulnerability

Vivo AppStore is a mobile app from China Vivo. It is used to download APP. A security vulnerability exists in appstore versions prior to 8.12.0.0, which can be exploited by an attacker to remotely download and install apps via carefully constructed parameters...

Reolink P2P Cameras Trust Management Issue Vulnerability

Reolink P2P Cameras is a camera. A trust management issue vulnerability exists in Reolink P2P Cameras, which can be exploited by an attacker to obtain a fixed encryption key and access applications outside the local network access range. The vulnerability exists in the following devices or models...

Overstepped Access Vulnerability in Controller Technology's Little K Series Smart Sockets

Controller smart home through cutting-edge wireless technology to upgrade the home electrical equipment networking, so as to realize a variety of whole-house intelligent scene. The controller has a variety of smart sockets, designed in a compact form with a variety of functions, with a linkage...

Grundig Smart Inter@ctive 3.0 Insecure Direct Object Reference

Exploit Title: Grundig Smart Remote App CSRF Google Dork: Local Vulnerability Date: 06.07.2018 Exploit Author: Ahmethan GALTEKAdegN @inject0r16 Vendor Homepage: https://www.grundig.com/ Software Link: https://play.google.com/store/apps/details?id=arcelik. android.grundig.remote Version: Grundig...