GHSA-5C4W-8HHH-3C3H vulnerabilities

Vulnerabilities for packages: consul, consul-fips...

CVE-2025-43757

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7....

CVE-2025-50864

creationtimestamp| type| source ---|---|--- 2025-08-20 18:23:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwu2cxingk2a...

CVE-2025-9239 elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryption

A vulnerability was identified in elunez eladmin up to 2.7. Affected by this vulnerability is the function EncryptUtils of the file eladmin-common/src/main/java/me/zhengjie/utils/EncryptUtils.java of the component DES Key Handler. The manipulation of the argument STRPARAM with the input Passw0rd...

GHSA-56QJ-WP5R-MVHJ Liferay Portal Unvalidated File Upload

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through update 92 allows remote unauthenticated users guests to upload files via th...

CVE-2025-7777

creationtimestamp| type| source ---|---|--- 2025-08-20 14:22:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwtmu3ntwl2e...

CVE-2025-54925

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url...

CVE-2025-32010

creationtimestamp| type| source ---|---|--- 2025-08-20 13:30:45+00:00| seen| https://infosec.place/objects/19cbb903-c61a-4242-9dbf-2801249e8b08 2025-08-20 16:23:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwttm6sh5i2e...

CVE-2025-24322

creationtimestamp| type| source ---|---|--- 2025-08-20 13:30:16+00:00| seen| https://infosec.place/objects/223203e9-3cfa-4dca-b731-e8d3f96ad36a...

CVE-2025-9184

creationtimestamp| type| source ---|---|--- 2025-08-20 12:29:18+00:00| seen| https://t.me/truesecator/7347 2025-08-21 16:43:37+00:00| seen| https://poliverso.org/objects/0477a01e-e29b5790-dee7d8d408d4834a 2026-04-13 17:57:43+00:00| seen| Telegram/QSM9U3MpJV7mFfbmf8cUEPeceSXGKhNza4NVrhBUDTV1Q...

CVE-2025-57731

creationtimestamp| type| source ---|---|--- 2025-08-20 12:18:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwtfvkobuw2c...

CVE-2025-38602

In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for allocorderedworkqueue Add check for the return value of allocorderedworkqueue since it may return NULL pointer. Mitigation To mitigate this issue, prevent modules iwlcore, iwlwifi from being loaded...

CVE-2025-38591

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = u8 r1 + 169; exit; With pointer field sk being at offset 168 in skbuff. This access is...

CVE-2025-38554

In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma-mm is freed after vma-vmrefcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible after VMAs were allowed to be recycled by...

WordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Notice Bar versions = 3.1.3...

CVE-2025-49395

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through = 2.0.3...

CVE-2025-48171

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Cena Store cena allows PHP Local File Inclusion.This issue affects Cena Store: from n/a through = 2.11.26...

BELL-CVE-2025-38571

Bulletin has no description...

CVE-2025-23333

creationtimestamp| type| source ---|---|--- 2025-08-20 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-850/...

WordPress JobZilla - Job Board WordPress Theme Theme <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software JobZilla - Job Board WordPress Theme Type Theme Vulnerable versions = 2.0 Fixed in 2.0.1 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2025-49382 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 33cb80ce3eab Credi...