PT-2025-33651 · Liferay · Liferay Portal +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.10 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.1 through...

Malicious code in random-hobby-selector (npm)

The package random-hobby-selector was found to contain malicious code...

MAL-2025-31621 Malicious code in random-hobby-selector (npm)

The package random-hobby-selector was found to contain malicious code...

MAL-2025-25996 Malicious code in matches-dom-selector (npm)

The package matches-dom-selector was found to contain malicious code...

delegate-dom (>=0.0.0, <=0.0.1), dom-delegation-stream (0.0.0) +2 more potentially affected by unknown CVE via matches-dom-selector (0.0.0)

matches-dom-selector NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on matches-dom-selector and may be impacted: - delegate-dom =0.0.0, =1.0.0, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: OSV:MAL-2025-25996...

Malicious code in matches-dom-selector (npm)

The package matches-dom-selector was found to contain malicious code...

Malicious code in random-drink-selector (npm)

The package random-drink-selector was found to contain malicious code...

MAL-2025-9670 Malicious code in @wisetail/wds-selector (npm)

The package @wisetail/wds-selector was found to contain malicious code...

MAL-2025-31619 Malicious code in random-drink-selector (npm)

The package random-drink-selector was found to contain malicious code...

Malicious code in random-color-selector (npm)

The package random-color-selector was found to contain malicious code...

MAL-2025-31618 Malicious code in random-color-selector (npm)

The package random-color-selector was found to contain malicious code...

External Secrets 访问控制错误漏洞

External Secrets is a Kubernetes-related application from External Secrets open source. An access control error vulnerability exists in External Secrets versions prior to 0.15.0 through 0.19.2 that stems from the PushSecret controller not applying a namespace selector, which could lead to the...

BIT-LIBPYTHON-2024-12254 Unbounded memory buffering in SelectorSocketTransport.writelines()

Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer...

Conda-build 代码注入漏洞

Conda-build is a Conda open source command and tool for building conda packages. A code injection vulnerability exists in versions of Conda-build prior to 25.4.0 that stems from an insecure evaluation of recipe selectors and could lead to arbitrary code execution...

VulnCheck KEV: CVE-2022-1221

The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting...

CVE-2025-5443

A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvancedHidden. The manipulation of the...

CVE-2025-48883

Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding...

CVE-2025-48883 Chrome PHP is missing encoding in `CssSelector`

Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding...

Chrome PHP 跨站脚本漏洞

Chrome PHP is a headless chrome/chrome instance in PHP from the Chrome PHP open source. A cross-site scripting vulnerability exists in Chrome PHP versions prior to 1.14.0 that stems from a CSS selector expression that is not properly encoded, which could lead to a cross-site scripting attack...

Cross-site Scripting (XSS)

chrome-php/chrome is vulnerable to cross-site scripting XSS. The vulnerability is due to improper encoding due to CSS Selector expressions not being properly escaped, allowing injection of malicious scripts...