476 matches found
Liferay Portal Unauthenticated File Access via URL
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users guests to access via URL files...
CVE-2025-57744
creationtimestamp| type| source ---|---|--- 2025-08-20 06:33:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwssmnsezk2d...
CVE-2025-52338
creationtimestamp| type| source ---|---|--- 2025-08-19 20:23:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwrqjurmql26...
CVE-2018-1047
creationtimestamp| type| source ---|---|--- 2025-08-18 21:02:39+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lwpcbnx5vq2w...
CVE-2024-46757
creationtimestamp| type| source ---|---|--- 2025-08-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-07...
CVE-2025-55280
creationtimestamp| type| source ---|---|--- 2025-08-13 13:54:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lwbxyoydf42j...
CVE-2025-537848
creationtimestamp| type| source ---|---|--- 2025-08-13 05:23:56+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2025-0250...
CVE-2025-497077
creationtimestamp| type| source ---|---|--- 2025-08-13 05:22:17+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2025-0249...
CVE-2025-8885
creationtimestamp| type| source ---|---|--- 2025-08-12 12:08:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw7bnh4j4r2s 2026-01-21 21:18:16+00:00| seen| https://vulnerability.circl.lu/bundle/bbcbc485-b88d-4831-b8e9-6e37e7bd9875 2026-02-20 14:25:07+00:00| seen|...
CVE-2025-42975 Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)
SAP NetWeaver Application Server ABAP BIC Document allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to acces...
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target="blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...
GHSA-XCXH-6CV4-Q8P8 HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target="blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...
PT-2025-32604 · Sap · Sap Netweaver Application Server Abap
Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP affected versions not specified Description: SAP NetWeaver Application Server for ABAP is susceptible to a cross-site scripting issue. An unauthenticated attacker can create a URL containing a malicio...
PT-2025-34325 · Npm · Hfs
Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with target=" blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab. Details While most modern...
CVE-2025-8814
creationtimestamp| type| source ---|---|--- 2025-08-10 18:11:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lw2uz5eerv2e...
CVE-2025-4576
creationtimestamp| type| source ---|---|--- 2025-08-09 22:06:01+00:00| seen| https://gist.github.com/bolhasec/e6c336b3013233969c0fdbe523deab57 2026-03-26 12:26:37+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-4576.yaml 2026-03-30...
CVE-2025-33014
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the...
Roundup 跨站脚本漏洞
Roundup is an open source command line, web and email issue tracking system from Roundup. The system provides bug tracking, customer help desk and issue management. A cross-site scripting vulnerability exists in versions prior to Roundup 2.5.0, which stems from improper URL and template...
Improper Validation of Syntactic Correctness of Input
Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input via improper handling of user-supplied URLs by using the startswith method in imageutils.py. An...