Skip to content

Liferay vulnerabilities

Products

Newest

liferay dxpLiferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication ModuleCVE-2021-29041Fix available6.5 MediumMay 16, 2021
liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Reveals Data via Overly Verbose Error MessagesCVE-2021-29040Fix available5.3 MediumMay 16, 2021
liferay portalLiferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin PageCVE-2021-29039Fix available6.1 MediumMay 16, 2021
liferay portalLiferay Portal Vulnerable to Cross-Site Scripting (XSS) via User Name ParameterCVE-2020-254766.1 MediumJanuary 7, 2021
liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Bypass via Double Encoded URLCVE-2020-15840Fix available5.3 MediumSeptember 24, 2020
liferay portal, digital experience platform +1 moreUnrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXPCVE-2020-15839Fix available6.5 MediumSeptember 22, 2020
liferay portalOpen Redirect in Liferay PortalCVE-2020-24554Fix available7.5 HighSeptember 1, 2020
liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP have Insecure Deserialization VulnerabilityCVE-2020-15842Fix available8.1 HighJuly 20, 2020
liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe ConnectionCVE-2020-15841Fix available8.3 HighJuly 20, 2020
liferay portalLiferay Portal and Liferay DXP Fails to Sanitize API DataCVE-2020-13444Fix available6.5 MediumJune 10, 2020
liferay portalLiferay Portal and Liferay DXP Vulnerable to Arbitrary Code ExecutionCVE-2020-13445Fix available8.8 HighJune 10, 2020
liferay portalDeserialization of Untrusted Data in Liferay PortalCVE-2020-7961In KEVPublic exploitFix availableEPSS 99.9%9.8 CriticalMarch 20, 2020
liferay portalLiferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortletCVE-2020-7934Public exploitFix available5.4 MediumJanuary 28, 2020
liferay portalLiferay Portal Allows RCE via Deserialization of a JSON PayloadCVE-2019-16891Public exploitFix availableEPSS 44.7%9.8 CriticalOctober 4, 2019
liferay portalLiferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article TitleCVE-2019-16147Fix available6.1 MediumSeptember 9, 2019
liferay portalLiferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha APICVE-2019-6588Public exploitFix available4.7 MediumJune 3, 2019
liferay portalAn issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy...CVE-2019-11444Public exploitDisputedEPSS 12.6%7.2 HighApril 22, 2019
liferay portal** DISPUTED ** Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to...CVE-2018-10795Disputed8.8 HighMay 7, 2018
liferay portalLiferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp pageCVE-2017-1000425Fix available6.1 MediumJanuary 2, 2018
liferay portalIn Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as...CVE-2017-178686.1 MediumDecember 23, 2017
liferay portalLiferay Portal Vulnerable to XSS via Mishandled Title or Summary in the Web Content DisplayCVE-2017-12649Fix available6.1 MediumAugust 7, 2017
liferay portalLiferay Portal XSS VulnerabilityCVE-2017-12648Fix available6.1 MediumAugust 7, 2017
liferay portalLiferay Portal Vulnerable to XSS via a Knowledge Base Article TitleCVE-2017-12647Fix available6.1 MediumAugust 7, 2017
liferay portalLiferay Portal XSS VulnerabilityCVE-2017-12646Fix available6.1 MediumAugust 7, 2017
liferay portalLiferay Portal Vulnerable to XSS via an Invalid portletIdCVE-2017-12645Fix available6.1 MediumAugust 7, 2017
liferay portalLiferay Portal Vulnerable to XSS via a Crafted Redirect FieldCVE-2016-10404Fix available6.1 MediumAugust 7, 2017
liferayDirectory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified...CVE-2016-65179.8 CriticalJanuary 23, 2017
liferay portalShell command injection in Liferay PortalCVE-2010-5327Fix available8.8 HighJanuary 13, 2017
liferay portalLiferay Portal Vulnerable to XSS in Profile Search FunctionalityCVE-2016-3670Public exploitFix available6.1 MediumJune 13, 2016
liferay portalCross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and...CVE-2014-83493.5 LowNovember 24, 2014
liferay portalMultiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay...CVE-2014-29634.3 MediumJuly 10, 2014
liferay portalLiferay Portal vulnerable to arbitrary command injectionCVE-2011-1571Public exploitFix available6.8 MediumMay 7, 2011
liferay portalCross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0...CVE-2011-15703.5 LowMay 7, 2011
liferay portalCross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x...CVE-2011-15043.5 LowMay 7, 2011
liferay portalThe XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA,...CVE-2011-15033.5 LowMay 7, 2011
liferay portalLiferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows...CVE-2011-15024.0 MediumMay 7, 2011
liferay portalCross-site scripting (XSS) vulnerability in Liferay Portal before 5.3.0 allows remote attackers...CVE-2009-37424.3 MediumJanuary 7, 2010
novell teaming, liferay enterprise portal +1 moreMultiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal...CVE-2009-1294Public exploit4.3 MediumApril 16, 2009
liferay enterprise portalCross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in...CVE-2008-05634.3 MediumFebruary 4, 2008
liferay enterprise portalCross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4...CVE-2008-01824.3 MediumFebruary 4, 2008
liferay enterprise portalCross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows...CVE-2008-01814.3 MediumFebruary 4, 2008
liferay enterprise portalCross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal...CVE-2008-01804.3 MediumFebruary 4, 2008
liferay enterprise portalCross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay...CVE-2008-01792.6 LowFebruary 4, 2008
liferay enterprise portalCross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in...CVE-2008-0178Public exploit4.3 MediumFebruary 4, 2008
liferay enterprise portalCross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1...CVE-2007-6173Public exploit4.3 MediumNovember 30, 2007
liferay portalCross-site scripting (XSS) vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1...CVE-2007-6055Public exploit4.3 MediumNovember 20, 2007
liferay portal enterpriseCross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6...CVE-2005-4400Public exploit4.3 MediumDecember 20, 2005
liferay enterprise portalMultiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release...CVE-2004-2030Public exploit4.3 MediumMay 22, 2004