liferay liferay portal 7.3.5 vulnerabilities and exploits

(subscribe to this query)

8.8

CVSSv3

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findB...

Liferay Dxp 7.3 Liferay Liferay Portal 7.3.5

7.5

CVSSv3

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote malicious users to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTC...

Liferay Dxp Liferay Dxp 7.3 Liferay Liferay Portal 7.3.4 Liferay Liferay Portal 7.3.5

7.2

CVSSv3

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it i...

Liferay Liferay Portal 7.2 Liferay Liferay Portal 7.3.5

7.2

CVSSv3

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administr...

Liferay Liferay Portal 7.2 Liferay Liferay Portal 7.3.5

6.1

CVSSv3

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 up to and including 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote malicious users to inject arbitrary web script or HTML via a form field's help text to (1) Forms module's form b...

Liferay Liferay Portal Liferay Liferay Portal 7.4.0

6.1

CVSSv3

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote malicious users to inject arbitrary web script or HTML via the _com_liferay_...

Liferay Dxp 7.2 Liferay Dxp 7.3 Liferay Liferay Portal 7.3.4 Liferay Liferay Portal 7.3.5

6.1

CVSSv3

Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 up to and including 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote malicious users to inject arbitrary we...

Liferay Dxp 7.1 Liferay Dxp 7.2 Liferay Dxp 7.3 Liferay Liferay Portal

6.1

CVSSv3

Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 up to and including 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote malicious users to inject arbitrary web script or HTML via the _com_lifera...

Liferay Dxp 7.3 Liferay Liferay Portal

6.1

CVSSv3

Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 up to and including 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows re...

Liferay Dxp 7.0 Liferay Dxp 7.1 Liferay Dxp 7.2 Liferay Dxp 7.3 Liferay Liferay Portal

6.1

CVSSv3

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote malicious users to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_po...

Liferay Dxp 7.3 Liferay Liferay Portal 7.3.5

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook