https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:18:16 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0954 https://cve.radiocsirt.org/vuln/euvd-2026-254327 EUVD-2026-254327 https://cve.radiocsirt.org/vuln/euvd-2026-254327 https://cve.radiocsirt.org/vuln/fkie_cve-2025-43824 <p>The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.</p> <p>The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-43824 https://cve.radiocsirt.org/vuln/ghsa-pfxj-gvqg-mj44 <p><strong>Affected:</strong> Maven: com.liferay.portal:release.portal.bom</p> <p>The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.</p> <p><strong>Affected:</strong> Maven: com.liferay.portal:release.portal.bom</p> <p>The Profile Widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file is downloaded.</p> https://cve.radiocsirt.org/vuln/ghsa-pfxj-gvqg-mj44 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2214 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Liferay Portal und Liferay DXP ausnutzen, um Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Liferay Portal und Liferay DXP ausnutzen, um Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2214