CVE Vulnerability Catalog

A clickjacking vulnerability was found in Rems Employee Management System 1.0. It allows a remote attacker to execute arbitrary JavaScript on the department.php page by injecting a malicious payload into the Department Name field when adding a new department.

A stored XSS vulnerability exists in the /o/c/<object-name> API endpoint of a custom object in Liferay Portal and Liferay DXP. Remote attackers can inject arbitrary web script or HTML via the externalReferenceCode parameter.

In Liferay Portal (versions 7.1.0 through 7.4.3.111) and Liferay DXP (specific versions), the default membership type of a newly created site is "Open", allowing any registered user to become a member. A remote attacker with site membership can view, add, or edit content on the site.

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, allowing remote users to access and edit content via the API.

A weakness has been identified in SpyShelter up to 15.4.0.1015. An unknown function in the library SpyShelter.sys of the IOCTL Handler component can be manipulated to cause denial of service. The attack requires local access, and the exploit has been made publicly available.

A cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111 and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a rich text type field.

Multiple cross-site scripting (XSS) vulnerabilities exist in Liferay Portal and Liferay DXP within "Rich Text" type fields in web content structures, Documents and Media Document Types, and custom assets. A remote attacker can inject arbitrary web script or HTML via a crafted payload.

From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access so that the payload is executed in the browser of any user who visits the resulting public chat URL.

Liferay Portal and Liferay DXP do not properly obtain the remote address of the live site from the database, allowing remote authenticated users to exfiltrate data to an attacker-controlled server (a fake "live site") via the _com_liferay_exportimport_web_portlet_ExportImportPortlet_remoteAddress and _com_liferay_exportimport_web_portlet_ExportImportPortlet_remotePort parameters. To exploit, an attacker must also obtain the staging server's shared secret and add the attacker-controlled server to the staging server's whitelist.

A vulnerability was detected in ZKEACMS 4.3 in the Proxy function of MediaController.cs. Manipulating the url argument results in server-side request forgery. The attack can be initiated remotely and the exploit is publicly available.

In the Linux kernel, the CoreSight subsystem had an ACPI buffer memory leak (buf.pointer) reported by kmemleak. The buffer was used after returning from acpi_get_dsd_graph() and was not freed. The fix moves temporary variables into acpi_coresight_parse_graph() and frees the buffer before the function returns.

In the Linux kernel, a vulnerability in the EROFS filesystem was found due to insufficient atomic context detection in z_erofs_decompressqueue_endio. When called under RCU lock, it can invoke a sleeping function (mutex_lock) in an invalid context, leading to a kernel BUG.

In the Linux kernel's NTFS3 filesystem (fs/ntfs3), a missing null pointer check in attr_load_runs_vcn can lead to a null pointer dereference (NPD) when mounting a malformed NTFS image, causing a kernel crash.

In the Linux kernel, a flaw exists in aperture_remove_conflicting_pci_devices() where sysfb_disable() is not called before removing PCI devices. As a result, simpledrm can still bind to simple-framebuffer devices after the hardware driver has taken over, causing driver interference and undefined behavior, including modesetting errors and RCU stalls.

A memory leak (kobjects) was found in the orangefs_sysfs_init() function of the OrangeFS module in the Linux kernel. When inserting and removing the orangefs module, kobject objects are not freed, leading to memory exhaustion.

In the Linux kernel, a vulnerability was found in the F2FS filesystem during recovery. Missing validation of the destination block address (blkaddr) in the SIT table can lead to inconsistency, triggering a warning or kernel panic when CONFIG_F2FS_CHECK_FS is enabled. The issue was reported by Wenqing Liu and affects filesystem images with corrupted metadata.

In the Linux kernel's NTFS3 driver, the record_size field in the NTFS boot record lacks proper validation. When negative, it is treated as a shift value, and the lack of sanity checks can lead to a calculated size below 256 bytes, causing a NULL pointer dereference when mounting a crafted NTFS image.

In the Linux kernel ext4 filesystem, a deadlock can occur during fs reclaim with page writeback. The filesystem-wide lock protecting ext4_writepages() can cause a thread to block forever when it tries to reacquire the lock during memory reclaim.

In the Linux kernel USB dwc3 driver, a rarely observed endpoint command timeout causes a kernel panic when panic_on_warn is enabled or unnecessary call traces otherwise. It occurs during fast software-controlled connect/disconnect tests. The fix removes WARN_ON where device endpoint commands are sent.

A stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote authenticated attackers with the instance administrator role to inject arbitrary web script or HTML into all pages via a crafted payload injected into the Instance Configuration's CDN Host HTTP or CDN Host HTTPS text fields.