CVE-2023-37940
- EPSS 0.07%
- Veröffentlicht 17.12.2024 22:15:05
- Zuletzt bearbeitet 28.01.2025 21:18:48
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to in...
CVE-2024-11993
- EPSS 0.07%
- Veröffentlicht 17.12.2024 21:15:07
- Zuletzt bearbeitet 28.03.2025 20:15:20
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field
CVE-2024-8980
- EPSS 0.06%
- Veröffentlicht 22.10.2024 15:15:07
- Zuletzt bearbeitet 10.12.2024 21:07:09
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2...
CVE-2024-38002
- EPSS 0.9%
- Veröffentlicht 22.10.2024 15:15:06
- Zuletzt bearbeitet 10.09.2025 16:15:34
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating...
CVE-2024-26271
- EPSS 0.12%
- Veröffentlicht 22.10.2024 15:15:05
- Zuletzt bearbeitet 10.12.2024 21:07:04
Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through...
CVE-2024-26272
- EPSS 0.17%
- Veröffentlicht 22.10.2024 15:15:05
- Zuletzt bearbeitet 10.12.2024 21:07:02
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allo...
CVE-2024-26273
- EPSS 0.12%
- Veröffentlicht 22.10.2024 15:15:05
- Zuletzt bearbeitet 10.12.2024 21:07:07
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 update 29 through update ...
CVE-2023-47795
- EPSS 0.39%
- Veröffentlicht 21.02.2024 14:15:45
- Zuletzt bearbeitet 28.01.2025 21:17:39
Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary ...
CVE-2024-25151
- EPSS 0.36%
- Veröffentlicht 21.02.2024 04:15:08
- Zuletzt bearbeitet 28.01.2025 02:28:11
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notificatio...
CVE-2024-25603
- EPSS 0.2%
- Veröffentlicht 21.02.2024 03:15:09
- Zuletzt bearbeitet 28.01.2025 02:39:55
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsup...