CVE-2025-43740

CVE-2025-43740 is a stored XSS vulnerability in Liferay Portal and Liferay DXP. Affected: Liferay Portal 7.4.3.120–7.4.3.132 and Liferay DXP 2025.Q1.0–Q2.8 (also Q4/Q3/Q2/Q1 2024). The issue allows a remote authenticated attacker to inject JavaScript via the web interface’s message boards feature...

PT-2025-33726 · Liferay · Liferay Portal +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.120 through 7.4.3.132 Liferay DXP versions 2025.Q2.0 through 2025.Q2.8 Liferay DXP versions 2025.Q1.0 through 2025.Q1.15 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in message board threads and categories. An attacker can execute arbitrary JavaScript code in the context of another user by injecting malicious scripts into these fields. Details Cross-site scripting or XSS is ...

GHSA-3P2M-574V-V257 Liferay Portal Vulnerable to Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows ...

Liferay Portal Vulnerable to Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows ...

CVE-2025-43731

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows ...

CVE-2025-43731

This CVE is a reflected XSS in Liferay Portal and Liferay DXP. Affected products and versions include Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP releases 2025.Q1.0–2025.Q1.8, 2024.Q4.0–2024.Q4.7, 2024.Q3.1–2024.Q3.13, 2024.Q2.0–2024.Q2.13, 2024.Q1.1–2024.Q1.16, and 7.4 GA through update 92. T...

CVE-2025-43731

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows ...

CVE-2025-43731

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows ...

PT-2025-33681 · Liferay · Liferay Portal +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.8 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.0 through...

The vulnerability of microprogrammed network board software from ASR Microelectronics, such as ASR1803L, ASR1806, ASR1901, and ASR1903L, arises from the execution of operations beyond the buffer boundaries in memory. This allows attackers to cause system failures.

The vulnerability of microprogrammed network boards from ASR Microelectronics, such as ASR1803L, ASR1806, ASR1901, and ASR1903L, stems from an operation where data is written beyond the buffer boundaries in memory during the processing of the LzmaEnc.c file apps/lzma/src/LzmaEnc.c. Exploiting thi...

The vulnerability of microprogrammed network boards from ASR Microelectronics, such as ASR1803L, ASR1806, ASR1901, and ASR1903L, arises due to improper cleaning or release of resources. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of microprogrammed network board software from ASR Microelectronics, including models ASR1803L, ASR1806, ASR1901, and ASR1903L, stems from improper cleaning or release of resources during the processing of the pb.c file router/phonebook/pb.c. Exploiting this vulnerability can...

The vulnerability of microprogrammed network board software from ASR Microelectronics, such as ASR1803L, ASR1806, ASR1901, and ASR1903L, arises from the execution of operations beyond the buffer boundaries in memory. This allows attackers to cause system failures.

The vulnerability of microprogrammed network board software from ASR Microelectronics, including models ASR1803L, ASR1806, ASR1901, and ASR1903L, arises due to the operation of an action that goes beyond the buffer boundaries in memory during the processing of the file devapi.c...

The vulnerability of microprogrammed network boards from ASR Microelectronics, such as ASR1803L, ASR1806, ASR1901, and ASR1903L, arises due to improper cleaning or release of resources. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of microprogrammed network board software from ASR Microelectronics, including models ASR1803L, ASR1806, ASR1901, and ASR1903L, stems from improper cleaning or release of resources during the processing of the router/sms/sms.c file. Exploiting this vulnerability can allow an...

CVE-2024-50578

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page...

CVE-2023-40606

Improper Control of Generation of Code 'Code Injection' vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21...

CVE-2023-1776

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file...

CVE-2023-3904

An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the details shown in the issue boards...

CVE-2023-22662

Improper input validation of EpsdSrMgmtConfig in UEFI firmware for some IntelR Server Board S2600BP products may allow a privileged user to potentially enable denial of service via local access...

CVE-2023-0873

The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...