netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-hwp2-gvm5-452f
GHSA-hmrx-6pr5-hpwj
GHSA-p63m-vmjr-wg37
GHSA-hmrx-6pr5-hpwj
GHSA-p63m-vmjr-wg37
This commit is contained in:
advisory-database[bot]
2025-04-28 19:32:03 +00:00
parent e706795bfa
commit 4628feb30a
5 changed files with 309 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-hwp2-gvm5-452f/GHSA-hwp2-gvm5-452f.json → advisories/github-reviewed/2022/05/GHSA-hwp2-gvm5-452f/GHSA-hwp2-gvm5-452f.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hwp2-gvm5-452f",
"modified": "2024-04-04T00:51:08Z",
"modified": "2025-04-28T19:30:32Z",
"published": "2022-05-24T16:47:03Z",
"aliases": [
"CVE-2019-6588"
],
"summary": "Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API",
"details": "In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the \"url\" parameter of the JSP taglib call <liferay-ui:captcha url=\"<%= url %>\" /> or <liferay-captcha:captcha url=\"<%= url %>\" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.1.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -23,6 +44,10 @@
"type": "WEB",
"url": "https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html"
@@ -33,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-28T19:30:32Z",
"nvd_published_at": "2019-06-03T20:29:00Z"
}
}
advisories/github-reviewed/2024/10/GHSA-hmrx-6pr5-hpwj/GHSA-hmrx-6pr5-hpwj.json
+140
View File
@@ -0,0 +1,140 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hmrx-6pr5-hpwj",
"modified": "2025-04-28T19:29:54Z",
"published": "2024-10-22T18:32:11Z",
"aliases": [
"CVE-2024-26273"
],
"summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor",
"details": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the `_com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect` parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.3.104"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2023.Q4.0"
},
{
"fixed": "2023.Q4.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2023.Q3.1"
},
{
"fixed": "2023.Q3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.4.GA"
},
{
"fixed": "7.4u93"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 7.4u92"
}
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.3u29"
},
{
"fixed": "7.3u36"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26273"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-04-28T19:29:54Z",
"nvd_published_at": "2024-10-22T15:15:05Z"
}
}
advisories/github-reviewed/2024/10/GHSA-p63m-vmjr-wg37/GHSA-p63m-vmjr-wg37.json
+140
View File
@@ -0,0 +1,140 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p63m-vmjr-wg37",
"modified": "2025-04-28T19:29:29Z",
"published": "2024-10-22T18:32:11Z",
"aliases": [
"CVE-2024-26272"
],
"summary": "Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor",
"details": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.3.2"
},
{
"fixed": "7.4.3.108"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2023.Q4.0"
},
{
"fixed": "2023.Q4.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2023.Q3.1"
},
{
"fixed": "2023.Q3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.3.GA"
},
{
"fixed": "7.3u36"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.4.GA"
},
{
"fixed": "7.4u93"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 7.4u92"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26272"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-04-28T19:29:28Z",
"nvd_published_at": "2024-10-22T15:15:05Z"
}
}
advisories/unreviewed/2024/10/GHSA-hmrx-6pr5-hpwj/GHSA-hmrx-6pr5-hpwj.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hmrx-6pr5-hpwj",
"modified": "2024-10-22T18:32:11Z",
"published": "2024-10-22T18:32:11Z",
"aliases": [
"CVE-2024-26273"
],
"details": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the _com_liferay_commerce_catalog_web_internal_portlet_CommerceCatalogsPortlet_redirect parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26273"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26273"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-22T15:15:05Z"
}
}
advisories/unreviewed/2024/10/GHSA-p63m-vmjr-wg37/GHSA-p63m-vmjr-wg37.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p63m-vmjr-wg37",
"modified": "2024-10-22T18:32:11Z",
"published": "2024-10-22T18:32:11Z",
"aliases": [
"CVE-2024-26272"
],
"details": "Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to (1) change user passwords, (2) shut down the server, (3) execute arbitrary code in the scripting console, (4) and perform other administrative actions via the p_l_back_url parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26272"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-26272"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-22T15:15:05Z"
}
}