Skip to contentLiferay Portal vulnerabilities
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site ScriptingCVE-2024-26269Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to stored Cross-site ScriptingCVE-2024-26266Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to reflected Cross-site ScriptingCVE-2023-42496Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site ScriptingCVE-2024-25603Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site ScriptingCVE-2024-25152Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site ScriptingCVE-2024-25601Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site ScriptingCVE-2024-25602Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to Cross-site ScriptingCVE-2024-25147Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP vulnerable to theft of hashed passwordCVE-2024-26270Fix available6.5 Medium
- liferay dxp, portal, ibexa digital experience platform +1 more +3 moreLiferay Portal and Liferay DXP User Enumeration VulnerabilityCVE-2024-26268Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP HTTP Header Can Expose VersionsCVE-2024-26267Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to Denial of ServiceCVE-2024-26265Fix available5.0 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has a Stored XSS with Blog entries (Insecure defaults)CVE-2024-25610Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward SlashesCVE-2024-25609Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement CharacterCVE-2024-25608Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal defaults to a low work factor for the default password hashing algorithmCVE-2024-25607Fix available8.1 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has an XXE vulnerability in Java2WsddTask._formatCVE-2024-25606Fix available8.0 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or APICVE-2024-25605Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit PermissionsCVE-2024-25604Fix available6.5 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control PanelCVE-2024-25150Fix available4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site OptionsCVE-2024-25149Fix available5.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region PageCVE-2023-5190Fix available6.1 Medium
- liferay portal, digital experience platform +1 morePrivilege escalation in Liferay PortalCVE-2022-45320Fix available6.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Does Not Obfuscate Password Reminder AnswersCVE-2021-29038Fix available6.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to user impersonationCVE-2024-25148Fix available5.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows attackers to discover the existence of sitesCVE-2024-25146Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal denial-of-service vulnerabilityCVE-2024-25144Fix available4.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's account lockout does not invalidate existing user sessionsCVE-2023-47798Fix available5.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal stored cross-site scripting (XSS) vulnerabilityCVE-2024-25145Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal denial of service (memory consumption)CVE-2024-25143Fix available6.5 Medium
- liferay portalLiferay Portal XSS with `p_l_back_url_title` on edit content pageCVE-2023-47797Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS in the Commerce ModuleCVE-2023-42627Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS in the Wiki WidgetCVE-2023-42628Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect ClassCVE-2023-44311Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree MenuCVE-2023-44310Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS in the Fragment ComponentsCVE-2023-44309Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary PageCVE-2023-42629Fix available9.0 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation PageCVE-2023-42497Fix available9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Organization Selector Does Not Check User PermissionsCVE-2023-3426Fix available4.3 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to CSRF via the Layout ModuleCVE-2023-35030Fix available8.8 High
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to Open Redirect via the Layout ModuleCVE-2023-35029Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS via the Layout ModuleCVE-2023-3193Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal has Inefficient Regular ExpressionCVE-2023-33950Fix available6.5 Medium
- liferay dxp, portal, digital experience platform +2 moreInsecure Default Initialization In Liferay PortalCVE-2023-33949Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreMissing authorization in Liferay portalCVE-2023-33948Fix available5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay portal has unauthorized access to object definition via searchCVE-2023-33947Fix available2.7 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay portal unauthorized access to objects via OAuth 2 scopeCVE-2023-33946Fix available2.7 Low
- liferay dxp, portal, digital experience platform +2 moreSQL injection in Liferay PortalCVE-2023-33945Fix available6.4 Medium
- liferay dxp, portal, digital experience platform +2 moreCross-site scripting in Liferay PortalCVE-2023-33944Fix available4.8 Medium
- liferay dxp, portal, digital experience platform +2 moreCross-site scripting in Liferay PortalCVE-2023-33943Fix available5.4 Medium
- Show moreLoading…