deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 10.1.0-M1, < 10.1.45
Patched in: 10.1.45

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 11.0.0-M1, < 11.0.11
Patched in: 11.0.11

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 10.1.0-M1, < 10.1.45
Patched in: 10.1.45

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 11.0.0-M1, < 11.0.11
Patched in: 11.0.11

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 10.1.0-M1, < 10.1.45
Patched in: 10.1.45

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 11.0.0-M1, < 11.0.11
Patched in: 11.0.11

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-7whh-79j3-7c55
Package: de.themoep:inventorygui (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-837: Improper Enforcement of a Single, Unique Action
Vulnerable versions: < 1.6.5
Patched in: 1.6.5

Summary: InventoryGui allows item duplication in GUIs which use GuiStorageElement

Details:
### Impact
Any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element.

### Patches
InventoryGui 1.6.5 (included in latest 1.6.5-SNAPSHOT) by disabling GuiStorageElement when not running on 1.21.9 or later.

### Workarounds
Not using the GuiStorageElement.
GitHub Security Advisory: GHSA-jv6h-4262-q663
Package: org.bouncycastle:bcprov-debug-lts8on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.73.0, <= 2.73.7
Patched in: 2.73.8

Summary: Bouncy Castle Vulnerable to Uncontrolled Resource Consumption

Details:
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java.

This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
GitHub Security Advisory: GHSA-jv6h-4262-q663
Package: org.bouncycastle:bc-fips (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 2.1.0, <= 2.1.1
Patched in: 2.1.2

Summary: Bouncy Castle Vulnerable to Uncontrolled Resource Consumption

Details:
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules), Legion of the Bouncy Castle Inc. Bouncy Castle for Java LTS bcprov-lts8on on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/fips/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCFB.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeEngine.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCBC.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeGCMSIV.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCCM.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/engines/AESNativeCTR.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA256NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA224NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA3NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHAKENativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA512NativeDigest.Java, core/src/main/jdk1.9/org/bouncycastle/crypto/digests/SHA384NativeDigest.Java.

This issue affects Bouncy Castle for Java FIPS: from 2.1.0 through 2.1.1; Bouncy Castle for Java LTS: from 2.73.0 through 2.73.7.
GitHub Security Advisory: GHSA-9wq6-87hw-6mhc
Package: tech.powerjob:powerjob-server-starter (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 5.1.2
Patched in: unpatched

Summary: PowerJob OpenAPIController is missing authorization 

Details:
A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAPIController. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
GitHub Security Advisory: GHSA-q8hq-4h99-fj7x
Package: org.keycloak:keycloak-quarkus-dist (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 26.3.0, < 26.4.1
Patched in: 26.4.1

Summary: Keycloak TLS Client-Initiated Renegotiation Denial of Service

Details:
Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the `-Djdk.tls.rejectClientInitiatedRenegotiation=true` Java system property in the Keycloak startup configuration.
GitHub Security Advisory: GHSA-q8hq-4h99-fj7x
Package: org.keycloak:keycloak-quarkus-dist (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 26.1.0, < 26.2.10
Patched in: 26.2.10

Summary: Keycloak TLS Client-Initiated Renegotiation Denial of Service

Details:
Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the `-Djdk.tls.rejectClientInitiatedRenegotiation=true` Java system property in the Keycloak startup configuration.
GitHub Security Advisory: GHSA-q8hq-4h99-fj7x
Package: org.keycloak:keycloak-quarkus-dist (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 26.0.16
Patched in: 26.0.16

Summary: Keycloak TLS Client-Initiated Renegotiation Denial of Service

Details:
Keycloak is vulnerable to a Denial of Service (DoS) attack due to the default JDK setting that permits Client-Initiated Renegotiation in TLS 1.2. An unauthenticated remote attacker can repeatedly initiate TLS renegotiation requests to exhaust server CPU resources, making the service unavailable. Immediate mitigation is available by setting the `-Djdk.tls.rejectClientInitiatedRenegotiation=true` Java system property in the Keycloak startup configuration.
GitHub Security Advisory: GHSA-rgvh-4m82-fvjq
Package: de.themoep:inventorygui (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-837: Improper Enforcement of a Single, Unique Action
Vulnerable versions: <= 1.6.3-SNAPSHOT
Patched in: 1.6.4-SNAPSHOT

Summary: InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement

Details:
### Impact
Any plugin using the GuiStorageElement is impacted when used on a server which allows the (currently experimental) Bundle items.

### Patches
Patched with https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c5a01778494 ("backported" to 1.6.3-SNAPSHOT)

Update to 1.6.4-SNAPSHOT to guarantee that it's included!

### Workarounds
Don't enable the experiment "Bundle" items or don't use the GuiStorageElement in GUIs.

### References
Original issue: https://github.com/Phoenix616/InventoryGui/issues/51
GitHub Security Advisory: GHSA-598q-jw82-5w66
Package: de.themoep:inventorygui (MAVEN)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions, CWE-837: Improper Enforcement of a Single, Unique Action
Vulnerable versions: <= 1.6.1-SNAPSHOT
Patched in: 1.6.2-SNAPSHOT

Summary: InventoryGui affected by item duplication in GUIs which use GuiStorageElement

Details:
### Impact
Any plugin using the `GuiStorageElement` is impacted.

### Patches
Patched with https://github.com/Phoenix616/InventoryGui/commit/27a52ef6d934a1c232e110e0010e4aa810c27029 ("backported" to 1.6.1-SNAPSHOT) Update to 1.6.2-SNAPSHOT to guarantee that it's included!

### Workarounds
Don't use the `GuiStorageElement` in GUIs.

### References
Original issue: https://github.com/Phoenix616/InventoryGui/issues/48
GitHub Security Advisory: GHSA-q95h-87j6-273x
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 97.0.0
Patched in: 97.0.0

Summary: Liferay Portal ComboServlet denial of service via large file combination

Details:
The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions  does not limit the number or size of the files it will combine, which allows remote attackers to create very large responses that lead to a denial of service attack via the URL query string.
GitHub Security Advisory: GHSA-gccf-r9xp-x8jx
Package: com.liferay:com.liferay.knowledge.base.web (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.109
Patched in: 5.0.109

Summary: Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page

Details:
Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions  allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.
GitHub Security Advisory: GHSA-wvv5-5g6x-hp7j
Package: net.mingsoft:ms-mcms (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 6.0.1
Patched in: unpatched

Summary: MCMS reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
GitHub Security Advisory: GHSA-j82q-c85j-xw4w
Package: com.liferay:com.liferay.portal.security.auth.verifier (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 6.0.26
Patched in: 6.0.26

Summary: Liferay Portal and DXP do not properly restrict access to OpenAPI

Details:
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted URL.
GitHub Security Advisory: GHSA-cqwv-9xh5-25fg
Package: com.liferay:com.liferay.search.experiences.service (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 3.0.84
Patched in: unpatched

Summary: Liferay Portal and DXP are Missing Authorization in Collection Provider

Details:
Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.
GitHub Security Advisory: GHSA-phjr-p9c5-hprx
Package: com.liferay:com.liferay.dynamic.data.mapping.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.0.122
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)

Details:
A  reflected cross-site scripting (XSS) vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows a remote, authenticated attacker to inject and execute JavaScript code via the _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_definition parameter. The malicious payload is executed within the victim's browser when they access a URL that includes the crafted parameter.
GitHub Security Advisory: GHSA-gr7h-xw4f-wh86
Package: org.sakaiproject.kernel:sakai-kernel-impl (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
Vulnerable versions: <= 23.3
Patched in: unpatched

Summary: Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl

Details:
### Impact
EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data.

### Patches
SAK-49866 is patched in Sakai 23.5, 25.0, and trunk. 

### Credits
- Reported by [Suraj Gangwar](https://www.linkedin.com/in/surajgangwar?trk=contact-info).
- Patched by Sam Ottenhoff (Longsight).
GitHub Security Advisory: GHSA-rx48-gqc2-4w47
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 114.1.0
Patched in: unpatched

Summary: Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.