24494 matches found
GHSA-PW86-QVX9-34R7 Liferay Portal Vulnerable to IDOR via audit events
Insecure Direct Object Reference IDOR vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported...
Liferay Portal Vulnerable to IDOR via audit events
Insecure Direct Object Reference IDOR vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported...
CVE-2025-36132
creationtimestamp| type| source ---|---|--- 2025-09-30 20:01:02+00:00| seen| Telegram/zoLIAWCFMbUL0-hzkABKVcrO9oeb3eUoytC8Bxdx1u8a3Gk...
CVE-2025-43827
Insecure Direct Object Reference IDOR vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported...
CVE-2025-43827
CVE-2025-43827 affects Liferay Portal 7.4.0–7.4.3.117 and Liferay DXP 2024.Q1.1–2024.Q1.5, 2023.Q4.x, 2023.Q3.x, and 7.4 GA through update 92. The issue is an Insecure Direct Object Reference (IDOR) where improper access control on com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditE...
GHSA-GPX4-37G2-C8PV Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
Summary In the default configuration, webhook.azuredevops.username and webhook.azuredevops.password not set, Argo CD’s /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index 0 is...
Improper Validation of Function Hook Arguments
Overview Affected versions of this package are vulnerable to Improper Validation of Function Hook Arguments in the /api/webhook endpoint via the affectedRevisionInfo function. An attacker can cause the server process to crash and disrupt service availability by sending a Gogs push event whose JSO...
Improper Validation of Function Hook Arguments
Overview Affected versions of this package are vulnerable to Improper Validation of Function Hook Arguments in the /api/webhook endpoint via the affectedRevisionInfo function. An attacker can cause the server process to crash and disrupt service availability by sending a Gogs push event whose JSO...
CVE-2025-35033
creationtimestamp| type| source ---|---|--- 2025-09-30 16:57:49+00:00| seen| Telegram/3221ls20U9KWC9GIxhjuBqnB1fjXR72e8-23Mlp2EvsslX4...
CVE-2025-57852
creationtimestamp| type| source ---|---|--- 2025-09-30 14:59:45+00:00| seen| Telegram/tzVVVEZnRF-Acx-BoJjqTYV8V4SsWMswzNbeAD4WdU506s...
CVE-2025-41096
creationtimestamp| type| source ---|---|--- 2025-09-30 11:57:22+00:00| seen| Telegram/k-hsExMdK7MlhRvGPWfqe4x8ErpIQIEBpDYc0n-EFAiD4I...
CVE-2025-8877
creationtimestamp| type| source ---|---|--- 2025-09-30 08:58:19+00:00| seen| Telegram/J8TUttA5kk0ABEFeJuro2Gq3q2xQ3WcyoUJ7BaGSufGbsQ4...
CVE-2025-11163
creationtimestamp| type| source ---|---|--- 2025-09-30 05:59:32+00:00| seen| Telegram/jblmDzS4h1AZ2WyXVALmPQWKCiUiERYwsgx9N6NiDmw-Rs...
CVE-2025-8214
creationtimestamp| type| source ---|---|--- 2025-09-30 03:58:33+00:00| seen| Telegram/7otDent9Ig63b1UGGHA75F-J48qvL87fzYX0UJKMptQlpoE...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when inviting users to an event. An attacker can execute arbitrary web script or inject HTML by supplying crafted input into the First Name, Middle text, or Last Name fields. Details Cross-site scripting or XSS ...
GHSA-PF86-4W35-CJ89 Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Multiple cross-site scripting XSS vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allo...
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Multiple cross-site scripting XSS vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 35 allo...
CVE-2025-59948
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a page that renders feed entries without CSP, it is possible to execute an XSS payload. The Allow API access authentication setting needs to ...