Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)

Cross-site scripting XSS vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin Page

Cross-site scripting XSS vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

GHSA-QCV4-GV43-498V Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin Page

Cross-site scripting XSS vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer...

Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused...

GHSA-9MXG-P873-6793 Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer...

GHSA-87X7-PWRX-JCH7 Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused...

PT-2022-6894 · Libtiff +8 · Libtiff +8

Name of the Vulnerable Software and Affected Versions: libtiff version 4.4.0rc1 Description: The issue is related to a double free or corruption in the rotateImage function at tiffcrop.c:8839. This can potentially allow a remote attacker to impact the confidentiality, integrity, and availability ...

PT-2022-3328 · Mariadb +9 · Mariadb +10

Name of the Vulnerable Software and Affected Versions: MariaDB versions 10.2 through 10.7 Description: The issue is related to a buffer overflow in the Item func in::cleanup/Item::cleanup processor function of the MariaDB database management system. This could allow a remote attacker to impact th...

GHSA-QRH7-X6FP-C2MP XML Entity Expansion (XEE) in Django

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute Nova Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service resource consumption and crash via an XML Entity Expansion XEE attack...

GHSA-H7JC-PG2R-MQJ4 Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

GHSA-FW3X-2PR2-5J64 GeSHi vulnerable to Directory Traversal

Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. dot dot in the 1 geshi-path or 2 geshi-lang-path parameter...

GHSA-CR49-FX2V-9P57 Symfony Denial of Service Via Long Password Hashing

The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service CPU consumption via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a...

GHSA-5QP6-78PR-GV8C PHP OpenID Library Denial of Service vulnerability

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via XRDS data containing an external entity declaration in conjunction with an entity...

GHSA-P358-58JJ-HP65 Improper Authentication in Apache ActiveMQ

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests...

MantisBT XSS through weak CSP when using Gravatar plugin

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

Umbraco CMS vulnerable to CSRF

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery CSRF attacks as demonstrated by editing user account information in the templates.asmx.cs file...

GHSA-48Q3-M4HF-56C9 TeamPass vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 label value of an item or 2 name of a role...

GHSA-XVX2-WQF5-JJGV typo3/cms-felogin Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

EUVD-2017-15882

Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile aka libaudiofile and Audio File Library 0.3.6 allows remote attackers to have unspecified impact via a crafted WAV file...