Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties files uploaded by object entry and stored in documentlibrary, via URL. Remediation Upgrade com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type to version 1.0.65 or...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties files uploaded by object entry and stored in documentlibrary, via URL. Remediation Upgrade com.liferay:com.liferay.frontend.js.web to version 5.0.125 or higher. References - GitHub...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties files uploaded by object entry and stored in documentlibrary, via URL. Remediation Upgrade com.liferay:com.liferay.object.web to version 1.0.219 or higher. References - GitHub Commit -...

CVE-2025-9340

creationtimestamp| type| source ---|---|--- 2025-08-22 12:14:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115072358506038626 2025-08-22 12:43:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwyibbohb62t...

CVE-2025-54551

Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. If exploited, a user of the product may escalate the privilege and access data that the user do not have permission to view by altering the parameters of the...

CVE-2025-41452

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions...

CVE-2025-41452 Post auth nginx configuration injection in Danfoss AK-SM8xxA Series

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions...

Craft CMS < 4.15.3 / 5.x < 5.7.5 External Control of Assumed-Immutable Web Parameter

The version of Craft CMS installed on the remote host is prior to 4.15.3 or 5.x prior to 5.7.5. It is, therefore, affected by an external control of assumed-immutable web parameter vulnerability: - Craft CMS redirects requests that require authentication to the login page and generates a session...

ROS-20250822-02

A vulnerability in the dom4j open source Java library for XML, XPath and XSLT is related to the improper cleansing of elements and attribute names in XML documents. Exploitation of the vulnerability could Allow an attacker acting remotely to launch an XXE attack on the target system...

Linux Distros Unpatched Vulnerability : CVE-2025-1540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, an...

Linux Distros Unpatched Vulnerability : CVE-2024-9870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2...

Malicious code in fb_helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd02d94679b40d95c81b651a29666a45452deabc83d8e33032104032eef13261 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

SUSE CVE-2025-55196

External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a...

CVE-2025-4044

Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL...

CVE-2025-47184

An XML external entities XXE injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve information disclosure and privilege escalation via a crafted ISys XML message...

CVE-2025-8023

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fails to sanitize path traversal sequences in template file destination paths, which allows a system admin to perform path traversal attacks via malicious path components, potentially enabling malicious file...

CVE-2025-27217

A Server-Side Request Forgery SSRF in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope...

CVE-2025-27217

A Server-Side Request Forgery SSRF in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope...

CVE-2025-27217

The CVE-2025-27217 entry concerns a Server-Side Request Forgery (SSRF) in the UISP Application. Affected software: UISP Application. Vulnerability: SSRF allowing a user with certain permissions to make requests outside the UISP scope. Root cause: SSF vulnerability within the UISP Application; imp...