Liferay Portal Vulnerable to Insecure Direct Object Reference

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference IDOR in the...

CVE-2025-43732

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference IDOR in the...

CVE-2025-43732

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference IDOR in the...

CVE-2025-43732

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference IDOR in the...

CVE-2025-43732

CVE-2025-43732 affects Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP 2025.Q1.0–2025.Q1.10, 2024.Q4.0–Q4.7, 2024.Q3.1–Q3.13, 2024.Q2.1–Q2.13, 2024.Q1.1–Q1.17, and 7.4 GA through update 92. The vulnerability is an Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay...

PT-2025-33651 · Liferay · Liferay Portal +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2025.Q1.0 through 2025.Q1.10 Liferay DXP versions 2024.Q4.0 through 2024.Q4.7 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q2.1 through...

Malicious code in random-hobby-selector (npm)

The package random-hobby-selector was found to contain malicious code...

MAL-2025-31621 Malicious code in random-hobby-selector (npm)

The package random-hobby-selector was found to contain malicious code...

MAL-2025-25996 Malicious code in matches-dom-selector (npm)

The package matches-dom-selector was found to contain malicious code...

Malicious code in matches-dom-selector (npm)

The package matches-dom-selector was found to contain malicious code...

Malicious code in random-drink-selector (npm)

The package random-drink-selector was found to contain malicious code...

MAL-2025-31619 Malicious code in random-drink-selector (npm)

The package random-drink-selector was found to contain malicious code...

MAL-2025-9670 Malicious code in @wisetail/wds-selector (npm)

The package @wisetail/wds-selector was found to contain malicious code...

Malicious code in random-color-selector (npm)

The package random-color-selector was found to contain malicious code...

MAL-2025-31618 Malicious code in random-color-selector (npm)

The package random-color-selector was found to contain malicious code...

External Secrets 访问控制错误漏洞

External Secrets is a Kubernetes-related application from External Secrets open source. An access control error vulnerability exists in External Secrets versions prior to 0.15.0 through 0.19.2 that stems from the PushSecret controller not applying a namespace selector, which could lead to the...

BIT-LIBPYTHON-2024-12254 Unbounded memory buffering in SelectorSocketTransport.writelines()

Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer...

Conda-build 代码注入漏洞

Conda-build is a Conda open source command and tool for building conda packages. A code injection vulnerability exists in versions of Conda-build prior to 25.4.0 that stems from an insecure evaluation of recipe selectors and could lead to arbitrary code execution...

VulnCheck KEV: CVE-2022-1221

The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting...

CVE-2025-5443

A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected is the function wirelessAdvancedHidden of the file /goform/wirelessAdvancedHidden. The manipulation of the...