Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
liferay portal vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2005-4400
Cross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6.1 and previous versions allows remote malicious users to inject arbitrary web script or HTML via the (1) _77_struts_action, (2) p_p_mode, and (3) p_p_state parameters.
Liferay Liferay Portal Enterprise
1 EDB exploit
6.1
CVSSv3
CVE-2017-17868
In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag.
Liferay Liferay Portal 6.1.0
6.1
CVSSv3
CVE-2021-29039
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote malicious users to inject arbitrary web script or HTML via the site name.
Liferay Liferay Portal 7.3.4
9.8
CVSSv3
CVE-2021-33990
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate how an unauthorized use...
Liferay Liferay Portal 6.2.5
8.1
CVSSv3
CVE-2024-25148
In Liferay Portal 7.2.0 up to and including 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor...
Liferay Dxp 7.2
Liferay Dxp 7.3
Liferay Liferay Portal
5.3
CVSSv3
CVE-2024-25146
Liferay Portal 7.2.0 up to and including 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not ha...
Liferay Dxp 7.2
Liferay Dxp 7.3
Liferay Liferay Portal
5.4
CVSSv3
CVE-2021-33336
Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 up to and including 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote malicious users to inject arbitrary web script or HTML via the _c...
Liferay Dxp 7.1
Liferay Dxp 7.2
Liferay Liferay Portal
7.5
CVSSv3
CVE-2021-33323
The Dynamic Data Mapping module in Liferay Portal 7.1.0 up to and including 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote malicious users to view the autosaved values by viewing the f...
Liferay Dxp 7.1
Liferay Dxp 7.2
Liferay Liferay Portal
4.3
CVSSv3
CVE-2021-33324
The Layout module in Liferay Portal 7.1.0 up to and including 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a si...
Liferay Dxp 7.1
Liferay Dxp 7.2
Liferay Liferay Portal
6.1
CVSSv3
CVE-2021-33332
Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 up to and including 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote malicious users to inject arbitrary web script or HTML via the _com_lif...
Liferay Dxp 7.1
Liferay Dxp 7.2
Liferay Liferay Portal
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32976
CVE-2024-33557
CVE-2024-36801
CVE-2024-35654
authentication bypass
CVE-2024-24919
CSRF
code execution
CVE-2024-27348
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
9
10
NEXT »