8753 matches found
Liferay Portal vulnerable to Stored XSS in Components portlet
Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via...
GHSA-RVMF-JW8G-R35R Liferay Portal vulnerable to Stored XSS in Components portlet
Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the components tab. An attacker can execute arbitrary web script or HTML by injecting malicious content that is rendered in the user's browser. Details Cross-site scripting or XSS is a code vulnerability tha...
CVE-2025-43769
Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via...
CVE-2025-43769
Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via...
CVE-2025-43769
CVE-2025-43769 describes a stored XSS in the Components portlet of Liferay Portal (7.4.0–7.4.3.131) and Liferay DXP (2024.Q3.1–2024.Q3.8, 2024.Q2.0–2024.Q2.13, 2024.Q1.1–2024.Q1.12, and 7.4 GA up to update 92). The vulnerability allows remote attackers to execute arbitrary web script or HTML via ...
CVE-2025-43769
Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via...
CVE-2025-43769
Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via...
PT-2025-34503 · Liferay · Liferay Portal +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.8 Description: A stored cross-site scripting XS...
CVE-2024-53496
Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication...
CVE-2025-55624
An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components...
CVE-2025-55624
An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components...
CVE-2024-53494
Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication...
CVE-2025-49424
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themepassion Support Ticket support-ticket allows Reflected XSS.This issue affects Support Ticket: from n/a through = 1.9...
CVE-2025-28041
Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication...
CVE-2024-53495
Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication...
Multiple Vulnerabilities in Third-Party Components Prior to SIEMENS SINEC OS V3.2
The RUGGEDCOM RST2428P is a SINEC OS-based Layer 2 Ethernet switch with up to 28 non-blocking interfaces.SCALANCE X switches are used for connecting industrial components such as programmable logic controllers PLCs or human machine interfaces HMIs. Multiple vulnerabilities exist in third-party...
CVE-2024-53496
The CVE-2024-53496 entry concerns my-site v1.0.2.RELEASE, where an incorrect access control in the doFilter function can allow an unauthenticated user to reach sensitive components. The issue is characterized as high-risk (CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U with C/H/I/A = High; base score 9.8). So...
CVE-2025-55624
CVE-2025-55624 affects Reolink for Android/iOS (Reolink app version 4.54.0.4.20250526). The root cause is an intent redirection vulnerability that allows unauthorized attackers to access internal functions or non-public components. Public references indicate a PoC exists, and the issue is categor...