Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
liferay liferay portal vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2021-33990
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized use...
Liferay Liferay Portal 6.2.5
9.8
CVSSv3
CVE-2022-42120
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 up to and including 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows malicious users to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
Liferay Dxp 7.3
Liferay Liferay Portal
Liferay Dxp 7.4
9.8
CVSSv3
CVE-2022-42122
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows malicious users to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
Liferay Liferay Portal 7.3.7
Liferay Dxp 7.3
9.8
CVSSv3
CVE-2020-7961
Deserialization of Untrusted Data in Liferay Portal before 7.2.1 CE GA2 allows remote malicious users to execute arbitrary code via JSON web services (JSONWS).
Liferay Liferay Portal
13 Github repositories
9.8
CVSSv3
CVE-2019-16891
Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.
Liferay Liferay Portal 7.1.0
Liferay Liferay Portal 7.0.6
Liferay Liferay Portal 7.0.5
Liferay Liferay Portal 7.0.4
Liferay Liferay Portal 7.0.3
Liferay Liferay Portal 7.0.2
Liferay Liferay Portal 7.0.1
Liferay Liferay Portal 7.0.0
Liferay Liferay Portal 6.2.5
Liferay Liferay Portal 6.2.4
Liferay Liferay Portal 6.2.3
Liferay Liferay Portal 6.2.2
Liferay Liferay Portal 6.2.1
Liferay Liferay Portal 6.2.0
Liferay Liferay Portal 6.1.2
Liferay Liferay Portal 6.1.1
Liferay Liferay Portal 6.1.0
Liferay Liferay Portal
Liferay Liferay Portal 7.1.1
Liferay Liferay Portal 7.1.2
Liferay Liferay Portal 7.1.3
Liferay Liferay Portal 7.2.0
1 Github repository
8.8
CVSSv3
CVE-2023-35030
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 up to and including 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote malicious users to execute arbitrary code in the scripting console via the...
Liferay Dxp 7.4
Liferay Liferay Portal
8.8
CVSSv3
CVE-2022-42121
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 up to and including 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated malicious users to execute arbitrary SQL comma...
Liferay Liferay Portal
Liferay Dxp 7.2
Liferay Dxp 7.1
Liferay Dxp 7.3
Liferay Dxp 7.4
8.8
CVSSv3
CVE-2021-29053
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findB...
Liferay Dxp 7.3
Liferay Liferay Portal 7.3.5
8.8
CVSSv3
CVE-2020-15841
Liferay Portal prior to 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote malicious users to obtain the LDAP server's password via the Test LDAP Connection...
Liferay Liferay Portal
Liferay Dxp 7.0
Liferay Dxp 7.1
Liferay Dxp 7.2
8.8
CVSSv3
CVE-2020-13445
In Liferay Portal prior to 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarke...
Liferay Liferay Portal 7.1.1
Liferay Liferay Portal 7.1
Liferay Liferay Portal 7.2
Liferay Liferay Portal 7.3
1 Github repository
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
type confusion
IMAP
CVE-2024-36103
CVE-2024-28995
CVE-2024-37325
CVE-2024-30078
CVE-2024-30082
SQL injection
CVE-2024-30052
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
6
NEXT »