CVE-2025-43734

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows...

CVE-2025-43734

Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP 2025.Q1.0–2025.Q1.10, 2024.Q4.0–2024.Q4.7, 2024.Q3.1–2024.Q3.13, 2024.Q2.1–2024.Q2.13, 2024.Q1.1–2024.Q1.16 and 7.4 GA through update 92 are affected by a reflected XSS in the first display label field of a custom sort widget. A remote authenticated ...

CVE-2025-5466

XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 Fix deployed on 02-Aug-2025 allows a remote authenticated attacker with admin privileges to trigger a denial of...

CVE-2025-5466

CVE-2025-5466 is an XML External Entity (XEE) vulnerability affecting Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. The issue allows a remote authenticated attacker with admin privileges to trigger a denial of service. Affected versions before the stated fixes ...

CVE-2025-8297

CVE-2025-8297 affects Ivanti Avalanche prior to version 6.4.8.8008. Multiple sources describe an incomplete configuration restriction that enables a remote authenticated attacker with admin privileges to achieve remote code execution. The confirmed impact is remote code execution with high severi...

CVE-2025-8297

Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution...

PT-2025-32679 · Ivanti · Ivanti Connect Secure +3

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.8 and 22.8R2 Ivanti Policy Secure versions prior to 22.7R1.5 Ivanti ZTA Gateway versions prior to 22.8R2.3-723 Ivanti Neurons for Secure Access versions prior to 22.8R1.4 Description: An XML...

Linux Distros Unpatched Vulnerability : CVE-2016-9449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms b...

Linux Distros Unpatched Vulnerability : CVE-2014-5020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to...

CVE-2025-51057

A local file inclusion LFI vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile' function call in '/apivedo/video/preview'...

CVE-2025-51058

Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery SSRF in the /apivedo/video/preview endpoint, which allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the "file" URL parameter...

CVE-2025-51052

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'filegetcontents' function call in '/apivedo/template'...

CVE-2025-51052

A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'filegetcontents' function call in '/apivedo/template'...

CVE-2025-8353

The CVE-2025-8353 entry concerns a UI synchronization issue in Devolutions Server (JIT) that affects versions prior to and including 2025.2.4.0. A remote authenticated attacker could exploit stale UI state during standard checkout processing to gain unauthorized access to deleted JIT Groups. Affe...

CVE-2024-53288

CVE-2024-53288 is an XSS vulnerability in the NTP Region functionality of Synology Router Manager (SRM) versions prior to 1.3.1-9346-11. The issue allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. Affected product: Syno...

CVE-2024-53287

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in VPN Setting functionality in Synology Router Manager SRM before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified...

CVE-2025-50126 Extension - rsjoomla.com - Stored XSS vulnerability RSBlog! component 1.11.6-1.14.5 for Joomla

A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jformtagstext parameter...

CVE-2024-32124

CVE-2024-32124 affects Fortinet FortiIsolator, specifically affected versions 2.3 through 2.4.4. The root cause is an improper access control in the logging component, which may allow a remote authenticated read-only attacker to alter logs by sending a crafted HTTP request. Documented impact is l...

PT-2025-30015 · Fortinet · Fortiisolator

Name of the Vulnerable Software and Affected Versions: FortiIsolator versions 2.3 through 2.4.4 Description: An improper access control issue exists in the logging component of FortiIsolator. A remote authenticated read-only attacker may be able to alter logs by sending a crafted HTTP request...

CVE-2025-0293

CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk...