Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
liferay liferay portal vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv3
CVE-2021-29052
The Data Engine module in Liferay Portal 7.3.0 up to and including 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStruc...
Liferay Dxp 7.3
Liferay Liferay Portal
5.4
CVSSv3
CVE-2022-38902
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote malicious users to inject arbitrary JS script or HTML into the name field of newly created topic.
Liferay Dxp 7.3
Liferay Liferay Portal
6.1
CVSSv3
CVE-2022-42113
A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 up to and including 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote malicious users to inject arbitrary web script or HTML via the `redirect` parameter.
Liferay Dxp 7.4
Liferay Liferay Portal
5.4
CVSSv3
CVE-2022-42119
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 up to and including 7.4.2 and Liferay DXP 7.3 before update 8.
Liferay Liferay Portal
Liferay Dxp 7.3
6.1
CVSSv3
CVE-2022-28980
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows malicious users to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.
Liferay Liferay Portal
Liferay Dxp 7.4
6.1
CVSSv3
CVE-2022-28982
A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows malicious users to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
Liferay Dxp 7.3
Liferay Liferay Portal
6.1
CVSSv3
CVE-2023-3193
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 up to and including 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote malicious users to inject arbitrary web script or HTML via the `_com_liferay_layo...
Liferay Dxp 7.4
Liferay Liferay Portal
4.8
CVSSv3
CVE-2021-33339
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 up to and including 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote malicious users to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortl...
Liferay Dxp 7.2
Liferay Liferay Portal
4.3
CVSSv3
CVE-2022-39975
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing malicious users to view unpublished "Conte...
Liferay Dxp 7.3
Liferay Dxp 7.4
Liferay Liferay Portal
5.3
CVSSv3
CVE-2024-25146
Liferay Portal 7.2.0 up to and including 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not ha...
Liferay Dxp 7.2
Liferay Dxp 7.3
Liferay Liferay Portal
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-36920
buffer overflow
CVE-2024-36913
CVE-2024-5497
CVE-2024-23917
CVE-2024-4956
server-side request forgery
CVE-2024-35468
SSTI
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »