Liferay Profile Widget does not prevent vCard extension spoofing

The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows...

EUVD-2021-10851

Malware in sbrugna...

EUVD-2012-2731

Malware in sbrugna...

EUVD-2005-0587

Malware in sbrugna...

EUVD-2002-0024

Malware in sbrugna...

EUVD-2004-1484

Malware in sbrugna...

EUVD-2015-5867

Malware in sbrugna...

EUVD-2013-3307

Malware in sbrugna...

EUVD-2021-18917

Malware in sbrugna...

EUVD-2005-1108

Malware in sbrugna...

EUVD-2010-2263

Malware in sbrugna...

EUVD-2016-10265

Malware in sbrugna...

EUVD-2008-0602

Malware in sbrugna...

EUVD-2017-0248

Malware in sbrugna...

EUVD-2009-1304

Malware in sbrugna...

Unity Linux 20.1070a Security Update: firefox (UTSA-2025-987441)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987441 advisory. When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a...

CVE-2025-43824

The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows...

CVE-2025-43824

The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows...

CVE-2025-43824

The CVE-2025-43824 affects the Profile widget in Liferay Portal 7.4.0–7.4.3.111 (and older unsupported versions) and Liferay DXP 2023.Q3–2023.Q4 and 7.4 GA up to update 92. The root cause is a user name being included in the Content-Disposition header, allowing remote authenticated users to chang...

CVE-2025-43824

The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows...