Liferay

Liferay Portal

180 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2023-33941

  • EPSS 0.25%
  • Published 24.05.2023 15:15:09
  • Last modified 21.11.2024 08:06:15

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject ar...

5.4

CVE-2023-33942

  • EPSS 0.14%
  • Published 24.05.2023 15:15:09
  • Last modified 21.11.2024 08:06:15

Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injec...

5.4

CVE-2023-33943

  • EPSS 0.14%
  • Published 24.05.2023 15:15:09
  • Last modified 21.11.2024 08:06:15

Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a ...

6.1

CVE-2023-33938

  • EPSS 0.1%
  • Published 24.05.2023 14:15:09
  • Last modified 21.11.2024 08:06:14

Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted p...

5.4

CVE-2023-33939

  • EPSS 0.14%
  • Published 24.05.2023 14:15:09
  • Last modified 21.11.2024 08:06:14

Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to in...

5.4

CVE-2023-33940

  • EPSS 0.08%
  • Published 24.05.2023 14:15:09
  • Last modified 21.11.2024 08:06:14

Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.

5.4

CVE-2023-33937

  • EPSS 0.14%
  • Published 24.05.2023 13:15:09
  • Last modified 21.11.2024 08:06:14

Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a...

9.8

CVE-2021-33990

Exploit
  • EPSS 58.27%
  • Published 16.04.2023 04:15:07
  • Last modified 21.11.2024 06:09:51

Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference link only shows frmfolders.html is accessible and does not demonstrate h...

4.8

CVE-2022-42131

  • EPSS 0.15%
  • Published 15.11.2022 02:15:12
  • Last modified 30.04.2025 15:15:56

Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and...

5.9

CVE-2022-42132

  • EPSS 0.22%
  • Published 15.11.2022 02:15:12
  • Last modified 30.04.2025 15:15:56

The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL ...