CVE-2024-25151

CVE-2024-25151 affects Liferay Portal 7.2.0–7.4.2 and Liferay DXP 7.3 before SP3, 7.2 before FP15, and older versions. The Calendar module does not escape user-supplied data in the default notification email template, enabling remote authenticated users to inject script/HTML via the calendar even...

CVE-2024-1675

CVE-2024-1675 affects Google Chrome/Chromium prior to version 122.0.6261.57. The vulnerability stems from insufficient policy enforcement in the Chrome Download pathway, enabling a remote attacker to bypass filesystem restrictions via a crafted HTML page. The issue is categorized as high severity...

CVE-2024-1673

CVE-2024-1673 affects Google Chrome/Chromium: a use-after-free in Accessibility in the renderer prior to 122.0.6261.57 can allow a remote attacker to potentially cause heap corruption via specific UI gestures. Affected product: Chromium/Chrome (Accessibility component) with root cause described a...

CVE-2024-1671

CVE-2024-1671 applies to Google Chrome, stemming from an improper Site Isolation implementation that allowed a remote attacker to bypass the Content Security Policy via a crafted HTML page. The vulnerability is described as affecting Chrome versions prior to 122.0.6261.57 . Public advisories indi...

CVE-2024-1669

CVE-2024-1669 affects Blink in Google Chrome and is fixed by upgrading to Chrome 122.0.6261.57. The vulnerability is an out-of-bounds memory access in Blink that could be triggered by a crafted HTML page, allowing a remote attacker to access memory. The CVE is documented with a high severity in t...

CVE-2023-42498

CVE-2023-42498 is a reflected XSS flaw in the Language Override edit screen of Liferay Portal 7.4.3.8–7.4.3.97 and Liferay DXP 2023.Q3 before patch 5 (and 7.4 update 4–92). The vulnerability arises from unsafely handling the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_ke...

CVE-2024-26269

CVE-2024-26269 is an XSS vulnerability in the Frontend JS module’s portlet.js affecting Liferay Portal 7.2.0–7.4.3.37 and Liferay DXP 7.4 (pre-38), 7.3 (pre-11), 7.2 (pre-fix pack 20), including older unsupported versions. The flaw allows remote attackers to inject arbitrary web script via the UR...

CVE-2023-42496

Vulnerability summary (CVE-2023-42496) : A reflected cross-site scripting (XSS) flaw affects Liferay Portal 7.3.3–7.4.3.97 and Liferay DXP 2023.Q3 before patch 6, as well as 7.4 GA through update 92 and 7.3 before update 34. The issue is triggered by supplying user-supplied input in the parameter...

CVE-2024-1631

CVE-2024-1631 describes a vulnerability in the editor-js/agent-js identity library where Ed25519KeyIdentity.generate may use an insecure seed instead of secure randomness when no seed is provided. The private key for identity 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe can be ...

CVE-2024-25152

CVE-2024-25152 affects Liferay Portal 7.2.0–7.4.2 and Liferay DXP 7.3 (before SP3) / 7.2 (before FP17) and older unsupported versions. The vulnerability is a stored XSS in the Message Board widget triggered via the filename of an attachment, allowing remote authenticated users to inject arbitrary...

CVE-2024-25602

Summary (CVE-2024-25602) Stored cross-site scripting (XSS) vulnerability in the Users Admin module’s edit user page of Liferay Portal (7.2.0–7.4.2) and Liferay DXP (7.3 before SP3, 7.2 before fix pack 17; older unsupported versions). An authenticated remote user can inject arbitrary web script or...

CVE-2024-25147

Affects Liferay Portal: HtmlUtil.escapeJsLink XSS in versions 7.2.0–7.4.1 (and older unsupported) and Liferay DXP 7.3 before SP3, 7.2 before FP15. Root cause is insufficient sanitization in HtmlUtil.escapeJsLink, allowing remote attackers to inject arbitrary web script or HTML via crafted javascr...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Information disclosure

Certain HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to information disclosure, when connections made by the device back to services enabled by some solutions may have been trusted without the appropriate CA certificate in the device's certificate store...

CVE-2024-25895

CVE-2024-25895 affects ChurchCRM 5.5.0. The vulnerability is a reflected cross-site scripting (XSS) in the /EventAttendance.php endpoint, exploitable via the type parameter. The underlying cause is improper handling of user-supplied input in that parameter, allowing an attacker to inject arbitrar...

CVE-2024-25898

CVE-2024-25898 describes a cross-site scripting vulnerability in ChurchCRM v5.5.0, specifically when editing an event in EventEditor.php where attacker-supplied input in the Event Sermon field can inject malicious JavaScript or HTML. The affected component is ChurchCRM’s EventEditor.php; root cau...

CVE-2024-25461

CVE-2024-25461 : A directory traversal vulnerability affects Creatio Terrasoft CRM v7.18.4.1532, allowing a remote attacker to obtain sensitive information via a crafted request to the terrasoft.axd component. Root cause is a directory traversal flaw in the terrasoft.axd handler; impact is unauth...

CVE-2023-24332

CVE-2023-24332 describes a stack overflow in the Tenda AC6 router. Affected device: Tenda AC6 with firmware US_AC6V5.0re_V03.03.02.01_cn_TDC01. The vulnerability can be triggered by a crafted POST request to /goform/PowerSaveSet, potentially allowing an attacker to run arbitrary commands. The con...

CVE-2024-25894

CVE-2024-25894 affects ChurchCRM 5.5.0, specifically EventEditor.php, where a time-based blind SQL injection via the EventCount POST parameter is reported. Affected item: ChurchCRM 5.5.0 /EventEditor.php; vulnerability class: Blind SQL Injection (Time-based). Underlying cause and impact are state...

CVE-2024-25897

CVE-2024-25897 affects ChurchCRM 5.5.0, specifically the FRCatalog.php endpoint where a time-based blind SQL injection is exploitable via the CurrentFundraiser GET parameter. Attack surface: web/API call to FRCatalog.php with CurrentFundraiser values can yield high-impact exposure (as reflected i...