liferay dxp vulnerabilities and exploits

(subscribe to this query)

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 up to and including 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows malicious users to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.

Liferay Dxp 7.3 Liferay Liferay Portal Liferay Dxp 7.4

A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows malicious users to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.

Liferay Liferay Portal 7.3.7 Liferay Dxp 7.3

Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 up to and including 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote malicious users to execute arbitrary code in the scripting console via the...

Liferay Dxp 7.4 Liferay Liferay Portal

A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 up to and including 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated malicious users to execute arbitrary SQL comma...

Liferay Liferay Portal Liferay Dxp 7.2 Liferay Dxp 7.1 Liferay Dxp 7.3 Liferay Dxp 7.4

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findB...

Liferay Dxp 7.3 Liferay Liferay Portal 7.3.5

Liferay Portal prior to 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote malicious users to obtain the LDAP server's password via the Test LDAP Connection...

Liferay Dxp 7.0 Liferay Dxp 7.1 Liferay Dxp 7.2 Liferay Liferay Portal

In Liferay Portal prior to 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarke...

Liferay Liferay Portal 7.1 Liferay Liferay Portal 7.1.1 Liferay Liferay Portal 7.2 Liferay Liferay Portal 7.3

1 Github repository

In Liferay Portal 7.2.0 up to and including 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor...

Liferay Dxp 7.2 Liferay Dxp 7.3 Liferay Liferay Portal

SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 up to and including 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows malicious users to execute arbitrary SQL commands via the name of a database table's p...

Liferay Digital Experience Platform 7.3 Liferay Digital Experience Platform 7.4 Liferay Liferay Portal

Liferay Portal prior to 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle malicious users to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.

Liferay Dxp 7.0 Liferay Dxp 7.1 Liferay Dxp 7.2 Liferay Liferay Portal

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook