Liferay Portal up to and including 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
liferay liferay portal