Skip to contentLiferay Portal vulnerabilities
- liferay portalLiferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameterCVE-2021-38264Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)CVE-2021-38265Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to properly import users from LDAPCVE-2021-38266Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP has incorrect default permissions for site membersCVE-2021-38268Fix available6.5 Medium
- liferay portalLiferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An...CVE-2020-28885Disputed7.2 High
- liferay portalLiferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An...CVE-2020-28884Disputed7.2 High
- liferay portalLiferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib moduleCVE-2021-35463Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library moduleCVE-2021-33337Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLsCVE-2021-33338Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)CVE-2021-33336Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site ScriptingCVE-2021-33339Fix available4.8 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to TakeoversCVE-2021-33335Fix available7.2 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)CVE-2021-33332Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Fails to Properly Check User PermissionsCVE-2021-33334Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Fails to Check User Permissions for Workflow SubmissionsCVE-2021-33333Fix available6.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLsCVE-2021-33331Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreExposure of Resource to Wrong Sphere in Liferay PortalCVE-2021-33330Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP does not properly check user permissionCVE-2021-33327Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary PageCVE-2021-33328Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS moduleCVE-2021-33326Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Stores User Passwords in CleartextCVE-2021-33325Fix available4.9 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to invalidate password reset tokens after useCVE-2021-33322Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Don't Check Permissions of PagesCVE-2021-33324Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP autosaves form data for other users to seeCVE-2021-33323Fix available7.5 High
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP insecure default configurationCVE-2021-33321Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rateCVE-2021-33320Fix available4.3 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Fails to Check PermissionsCVE-2021-29052Fix available4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin PageCVE-2021-29048Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher AppCVE-2021-29051Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin PageCVE-2021-29044Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP May Reveal S3 Store's Proxy PasswordCVE-2021-29043Fix available5.9 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to Multiple SQL InjectionsCVE-2021-29053Fix available8.8 High
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module ParameterCVE-2021-29046Fix available6.1 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin PageCVE-2021-29045Fix available6.1 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After UseCVE-2021-29047Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Reveals Data via Overly Verbose Error MessagesCVE-2021-29040Fix available5.3 Medium
- liferay portalLiferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin PageCVE-2021-29039Fix available6.1 Medium
- liferay portalLiferay Portal Vulnerable to Cross-Site Scripting (XSS) via User Name ParameterCVE-2020-254766.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Bypass via Double Encoded URLCVE-2020-15840Fix available5.3 Medium
- liferay portal, digital experience platform +1 moreUnrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXPCVE-2020-15839Fix available6.5 Medium
- liferay portalOpen Redirect in Liferay PortalCVE-2020-24554Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP have Insecure Deserialization VulnerabilityCVE-2020-15842Fix available8.1 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe ConnectionCVE-2020-15841Fix available8.3 High
- liferay portalLiferay Portal and Liferay DXP Fails to Sanitize API DataCVE-2020-13444Fix available6.5 Medium
- liferay portalLiferay Portal and Liferay DXP Vulnerable to Arbitrary Code ExecutionCVE-2020-13445Fix available8.8 High
- liferay portalDeserialization of Untrusted Data in Liferay PortalCVE-2020-7961In KEVPublic exploitFix availableEPSS 99.9%9.8 Critical
- liferay portalLiferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortletCVE-2020-7934Public exploitFix available5.4 Medium
- liferay portalLiferay Portal Allows RCE via Deserialization of a JSON PayloadCVE-2019-16891Public exploitFix availableEPSS 44.7%9.8 Critical
- liferay portalLiferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article TitleCVE-2019-16147Fix available6.1 Medium
- liferay portalLiferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha APICVE-2019-6588Public exploitFix available4.7 Medium
- Show moreLoading…