CVE-2024-25610

MEDIUM Year: 2024
CVSS v3 Score
5.4
Medium
Weakness Type
CWE-1188
View all →

Vulnerability Description

In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions, the default configuration does not sanitize blog entries of JavaScript, which allows remote authenticated users to inject arbitrary web script or HTML (XSS) via a crafted payload injected into a blog entry’s content text field.

Related Vulnerabilities

CVE-2025-27809

MEDIUM
CVSS:5.4(Medium)

Mbed TLS before 2.28.10 and 3.x before 3.6.3, on the client side, accepts servers that have trusted certificates for arbitrary hostnames unless the TLS client application calls mbedtls_ssl_set_hostnam...

CWE-11882025

CVE-2019-2197

MEDIUM
CVSS:5.5(Medium)

In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact l...

CWE-11882019

CVE-2020-0019

MEDIUM
CVSS:5.5(Medium)

In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local information disclosure in the kernel with no additional execution privileges needed. User interaction is...

CWE-11882020

CVE-2021-47343

MEDIUM
CVSS:5.5(Medium)

In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. re...

CWE-11882021

CVE-2022-20466

MEDIUM
CVSS:5.5(Medium)

In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an insecure default value. This could lead to ...

CWE-11882022

CVE-2022-36349

MEDIUM
CVSS:5.5(Medium)

Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated user to potentially enable denial of ser...

CWE-11882022