Security Vulnerabilities - CVEs Published In August 2025
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.
CVSS Score
5.4
EPSS Score
0.002
Published
2025-08-18
IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.
CVSS Score
7.5
EPSS Score
0.004
Published
2025-08-18
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewing the "document View Usages" page.
CVSS Score
2.3
EPSS Score
0.002
Published
2025-08-18
An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4933 and later
CVSS Score
7.1
EPSS Score
0.004
Published
2025-08-18
DIAEnergie - Reflected Cross-site Scripting
CVSS Score
5.9
EPSS Score
0.001
Published
2025-08-18
DIAEnergie - Reflected Cross-site Scripting
CVSS Score
5.9
EPSS Score
0.001
Published
2025-08-18
DIAEnergie - Reflected Cross-site Scripting
CVSS Score
5.9
EPSS Score
0.001
Published
2025-08-18
DIAEnergie - Stored Cross-site Scripting
CVSS Score
7.0
EPSS Score
0.002
Published
2025-08-18
A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email of the component Password Recovery Endpoint. The manipulation results in observable response discrepancy. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.
CVSS Score
2.9
EPSS Score
0.004
Published
2025-08-18
A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score
2.1
EPSS Score
0.004
Published
2025-08-18