Security
Headlines
HeadlinesLatestCVEs

Tag

#auth

GHSA-84pp-qr92-95c9: Liferay Portal users can upload an unlimited amount of files

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.

ghsa
#vulnerability#web#ddos#auth
GHSA-fvqv-593q-qp8r: Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect

GHSA-xwc5-q44v-p6gg: Liferay Portal User Enumeration Vulnerability via the Create Account Page

User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page.

GHSA-655h-hg88-5qmf: Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety

The API of `xcb::Connection` has constructors which allow an arbitrary `RawFd` to be used as a socket connection. On either failure of these constructors or on the drop of `Connection`, it closes the associated file descriptor. Thus, a program which uses an `OwnedFd` (such as a `UnixStream`) as the file descriptor can close the file descriptor and continue to attempt using it or close an already-closed file descriptor, violating I/O safety. Starting in version 1.6.0, `xcb` provides `Connection::connect_with_fd` and `Connection::connect_with_fd_and_extensions` as safe alternatives and deprecates the problematic functions.

Interpol Arrests Over 1K Cybercriminals in 'Operation Serengeti 2.0'

The operation disrupted countless scams, and authorities seized a significant amount of evidence and recovered nearly $100 million in lost funds.

GHSA-8p2f-fx4q-75cx: UnoPim has Broken Access Control

### Summary In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID. **Severity**: High CVSS Score 8.1 (CVSS 3.1 Vector: [AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H&version=3.1)) **Category**: Broken Access Control / Missing Authorization (OWASP A01:2021) **Impact**: Unauthorized product deletion -> data loss, possible business disruption ### Affected Behavior **Single delete (enforced):** **DELETE** `/admin/catalog/products/{id}` returns 401 with "This action is unauthorized" for users lacking the Delete privilege. **Mass delete (not enforced):** **POST** `/admin/catalog/products/mass-delete` allows deletion without the Delete privilege....

GHSA-gcqf-pxgg-gw8q: Dpanel has an arbitrary file read vulnerability

### Summary Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files. ### Details When a user logs into the administrative backend, this interface can read any files on the host/sever (given the necessary permissions), which may lead to system information leakage. The vulnerability lies in the GetFromUri function within the app/application/http/controller/compose.go file. The uri parameter submitted by the user in JSON format can be directly read and returned by os.ReadFile without proper security handling. ![image-20250702004157585](https://github.com/user-attachments/assets/1f0e683b-bf0b-49e6-8d68-833fcf3f214d) ![image-20250702004223184](https://github.com/user-attachments/assets/b5e89e02-f572-4edf-aaa8-566dea090d3f) ### PoC ```text POST /api/app/compose/get-from-uri HTTP/1.1 Host: x.x.x.x User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefo...

Clickjack attack steals password managers’ secrets

A clickjack attack was revealed this summer that can steal the credentials from password managers that are integrated into web browsers.

GHSA-gj8w-ffq9-6828: JeecgBoot SQL Injection Vulnerability

JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist restrictions.

GHSA-g6rx-6wfx-gj74: Bouncy Castle for Java has Out-of-Bounds Write Vulnerability

Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher. This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0.