Skip to contentLiferay vulnerabilities
Newest
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be CircumventedCVE-2022-28977Fix available6.1 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to XSS via Tag NameCVE-2022-28982Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS in the Site ModuleCVE-2022-28978Fix available5.4 Medium
- liferay dxp, portal +1 moreLiferay Portal Missing Authorization vulnerabilityCVE-2022-39975Fix available4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search ModuleCVE-2022-28979Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP allows arbitrary injection via web content template namesCVE-2022-26596Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP allows arbitrary injection via the site nameCVE-2022-26597Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to check permissions to view sites/groupsCVE-2022-26595Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP allows arbitrary injection via the name of an asset categoryCVE-2022-26593Fix available5.4 Medium
- liferay portalLiferay Portal and Liferay DXP allows arbitrary injection via form fieldCVE-2022-26594Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to check origin of event messagesCVE-2022-25146Fix available5.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell moduleCVE-2021-38269Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry pageCVE-2021-38267Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP cross-site scripting (XSS) vulnerability via the script consoleCVE-2021-38263Fix available6.1 Medium
- liferay portalLiferay Portal vulnerable to cross-site scripting (XSS) via the keywords parameterCVE-2021-38264Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS)CVE-2021-38265Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to properly import users from LDAPCVE-2021-38266Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP has incorrect default permissions for site membersCVE-2021-38268Fix available6.5 Medium
- liferay portalLiferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An...CVE-2020-28885Disputed7.2 High
- liferay portalLiferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An...CVE-2020-28884Disputed7.2 High
- liferay portalLiferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib moduleCVE-2021-35463Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library moduleCVE-2021-33337Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLsCVE-2021-33338Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)CVE-2021-33336Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site ScriptingCVE-2021-33339Fix available4.8 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to TakeoversCVE-2021-33335Fix available7.2 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)CVE-2021-33332Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Fails to Properly Check User PermissionsCVE-2021-33334Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Fails to Check User Permissions for Workflow SubmissionsCVE-2021-33333Fix available6.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLsCVE-2021-33331Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreExposure of Resource to Wrong Sphere in Liferay PortalCVE-2021-33330Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP does not properly check user permissionCVE-2021-33327Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary PageCVE-2021-33328Fix available5.4 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS moduleCVE-2021-33326Fix available6.1 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Stores User Passwords in CleartextCVE-2021-33325Fix available4.9 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP fails to invalidate password reset tokens after useCVE-2021-33322Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP Don't Check Permissions of PagesCVE-2021-33324Fix available4.3 Medium
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP autosaves form data for other users to seeCVE-2021-33323Fix available7.5 High
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP insecure default configurationCVE-2021-33321Fix available7.5 High
- liferay portal, digital experience platform +1 moreLiferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rateCVE-2021-33320Fix available4.3 Medium
- liferay dxp, digital experience platform +1 moreLiferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL ParameterCVE-2021-29049Fix available6.1 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Fails to Check PermissionsCVE-2021-29052Fix available4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin PageCVE-2021-29048Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher AppCVE-2021-29051Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin PageCVE-2021-29044Fix available6.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP May Reveal S3 Store's Proxy PasswordCVE-2021-29043Fix available5.9 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to Multiple SQL InjectionsCVE-2021-29053Fix available8.8 High
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module ParameterCVE-2021-29046Fix available6.1 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin PageCVE-2021-29045Fix available6.1 Medium
- liferay dxp, portal +1 moreLiferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After UseCVE-2021-29047Fix available7.5 High
- Show moreLoading…