Liferay Portal 7.4.3.81 < 7.4.3.86 Information Disclosure

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported versio...

GHSA-XPH3-VJCQ-G488 Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

The organization selector before 4.0.14 from Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions

The organization selector before 4.0.14 from Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

CVE-2023-3426

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

CVE-2023-3426

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

Design/Logic Flaw

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

CVE-2023-3426

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

PT-2023-24782

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.81 through 7.4.3.85 Liferay DXP 7.4 update 81 through 85 Description The organization selector does not check user permission, allowing remote authenticated users to obtain a list of all organizations...

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.

...

WordPress WordPress Dev Powers – Element Selector jQuery Powers Plugin Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Dev Powers – Element Selector jQuery Powers Plugin Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 441b1a9fb4...

Allowed calls in LSP6KeyManager doesn't allow calls with empty calldata

Lines of code Vulnerability details Bug Description Whenever a controller attempts to call a LSP0 account's execute function without the relevant SUPER permissions, LSP6ExecuteModule will check that the call is one of the whitelisted allowed calls. If the controller is trying to perform a call wi...

user with ADDEXTENSIONS and CHANGEEXTENSIONS will remove extension unintentional

Lines of code Vulnerability details Summary Adding extension use 4 bytes function selector to add new extension, and if user with ADDEXTENSIONS permission also has CHANGEEXTENSIONS permission and wants to add new extension and there is an extension with that function selector, extension will be...

Hotel Management System 跨站脚本漏洞

Hotel Management System is a hotel management system based MIS project by Prem Chand Saini, an individual developer in India. A security vulnerability exists in Online Hotel Management System Project In PHP v1.0.0, which stems from a cross-site scripting XSS vulnerability. The vulnerability can b...

Fallback handlers can trick users into calling functions of the AmbireAccount contract

Lines of code Vulnerability details Fallback handlers can trick users into calling functions of the AmbireAccount contract Selector clashing can be used to trick users into calling base functions of the wallet. Impact Fallback handlers provide extensibility to the Ambire wallet. The main idea her...

SUSE-SU-2023:2292-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - add kubernetes1.18-client-common as conflicts with kubernetes-client-bash-completion - Split individual completions into separate packages Update to version 1.23.17: releng: Update images, dependencies and version to Go 1.19.6 Update...

CVE-2023-33942

The CVE-2023-33942 entry describes a cross-site scripting (XSS) flaw in the Liferay Web Content Display widget’s article selector for Portal 7.4.3.50 and DXP 7.4 Update 50, where an attacker can inject arbitrary scripts via the Title field of a web content article. Affected product/versions: Life...

libreswan security and bug fix update

4.9-2.0.1.2 - Add libreswan-oracle.patch to detect Oracle Linux distro 4.9-2.2 - Update libreswan-4.9-2176248-authby-rsasig.patch 4.9-2.1 - Resolves: rhbz2187647 authby=rsasig fails in FIPS policy 4.9-2 - Fix CVE-2023-23009: remote DoS via crafted TS payload with an incorrect selector length...

Malicious code in docs-component-folder-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 029903e7351485fc54de0e50d6f2f3c9c822895bd8d97930476b5a69f23dd6f9 The OpenSSF Package Analysis project identified 'docs-component-folder-selector' @ 1.0.6 npm as malicious. It is considered malicious because: -...

libreswan: remote DoS via crafted TS payload with an incorrect selector length

A flaw was found in the Libreswan package. A crafted TS payload with an incorrect selector length may allow a remote attacker to cause a denial of service...

RHEL 9 : libreswan (RHSA-2023:2633)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:2633 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both...