Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
liferay dxp vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2021-33322
In Liferay Portal 7.3.0 and previous versions, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote malicious users to change the user’s ...
Liferay Dxp 7.0
Liferay Dxp 7.1
Liferay Dxp 7.2
Liferay Liferay Portal
7.5
CVSSv3
CVE-2021-29047
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote malicious users to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTC...
Liferay Dxp
Liferay Dxp 7.3
Liferay Liferay Portal 7.3.4
Liferay Liferay Portal 7.3.5
7.2
CVSSv3
CVE-2021-33335
Privilege escalation vulnerability in Liferay Portal 7.0.3 up to and including 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by edit...
Liferay Dxp 7.2
Liferay Dxp 7.1
Liferay Liferay Portal
6.5
CVSSv3
CVE-2024-25144
The IFrame widget in Liferay Portal 7.2.0 up to and including 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote auth...
Liferay Dxp 7.2
Liferay Dxp 7.3
Liferay Dxp 7.4
Liferay Liferay Portal
6.5
CVSSv3
CVE-2022-38512
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing malicious users to download a web content page's XLIFF translatio...
Liferay Liferay Portal
Liferay Dxp 7.4
6.5
CVSSv3
CVE-2021-38268
The Dynamic Data Mapping module in Liferay Portal 7.0.0 up to and including 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenti...
Liferay Digital Experience Platform 7.2
Liferay Liferay Portal
Liferay Digital Experience Platform
Liferay Digital Experience Platform 7.3
6.5
CVSSv3
CVE-2021-29041
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated malicious users to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user...
Liferay Dxp
Liferay Dxp 7.3
6.5
CVSSv3
CVE-2020-15839
Liferay Portal prior to 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Liferay Digital Experience Platform 7.1
Liferay Digital Experience Platform 7.2
Liferay Liferay Portal
6.5
CVSSv3
CVE-2020-13444
Liferay Portal 7.x prior to 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Provider...
Liferay Liferay Portal 7.1
Liferay Liferay Portal 7.1.1
Liferay Liferay Portal 7.2
Liferay Liferay Portal 7.3
6.3
CVSSv3
CVE-2021-33333
The Portal Workflow module in Liferay Portal 7.3.2 and previous versions, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submiss...
Liferay Dxp 7.0
Liferay Dxp 7.1
Liferay Dxp 7.2
Liferay Liferay Portal
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-7073
CVE-2024-5496
CVE-2024-5495
XPath injection
bypass
CVE-2024-30043
CVE-2024-24919
denial of service
CVE-2024-35468
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
NEXT »