CVE-2025-32781

CVE-2025-32781 affects Apollo Portal prior to 2.5.0, where an authenticated user can request a release by ID (GET /envs/{env}/releases/{releaseId}) with configView.memberOnly.envs enabled and read configuration data from other applications/namespaces. Root cause: missing application/namespace per...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to improper access control to OpenAPI. An attacker can retrieve sensitive OpenAPI YAML files by sending a specially crafted URL. Remediation Upgrade com.liferay:com.liferay.portal.security.auth.verifier to...

EUVD-2009-4123

Malware in sbrugna...

EUVD-2018-11940

Malware in sbrugna...

EUVD-2020-5697

Malware in sbrugna...

EUVD-2018-5328

Malware in sbrugna...

EUVD-2021-15689

Malware in sbrugna...

EUVD-2004-2503

Malware in sbrugna...

EUVD-2017-10233

Malware in sbrugna...

EUVD-2018-12024

Malware in sbrugna...

EUVD-2024-0781

Malicious code in bioql PyPI...

EUVD-2025-23958

Malicious code in bioql PyPI...

EUVD-2025-10388

Malicious code in bioql PyPI...

EUVD-2023-44092

Malicious code in bioql PyPI...

EUVD-2024-49203

Malicious code in bioql PyPI...

EUVD-2023-48665

Malicious code in bioql PyPI...

EUVD-2024-47825

Malicious code in bioql PyPI...

EUVD-2022-48127

Malicious code in bioql PyPI...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the comliferayportalsecurityauditwebportletAuditPortletauditEventId parameter. An attacker can access audit events belonging to a different virtual instance by specifying the identifi...

CVE-2021-29043

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middl...