Liferay

Dxp

154 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2023-3193

  • EPSS 0.14%
  • Published 15.06.2023 04:15:34
  • Last modified 21.11.2024 08:16:39

Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_lifer...

6.1

CVE-2022-42118

  • EPSS 33.29%
  • Published 15.11.2022 01:15:12
  • Last modified 13.05.2025 18:17:51

A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary we...

5.4

CVE-2022-42119

  • EPSS 0.52%
  • Published 15.11.2022 01:15:12
  • Last modified 30.04.2025 15:15:55

Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.

9.8

CVE-2022-42120

  • EPSS 0.3%
  • Published 15.11.2022 01:15:12
  • Last modified 05.09.2025 18:15:36

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attr...

8.8

CVE-2022-42121

  • EPSS 0.46%
  • Published 15.11.2022 01:15:12
  • Last modified 05.09.2025 18:15:36

A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitra...

9.8

CVE-2022-42122

  • EPSS 0.3%
  • Published 15.11.2022 01:15:12
  • Last modified 05.09.2025 18:15:36

A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly U...

5.4

CVE-2022-42111

  • EPSS 0.14%
  • Published 15.11.2022 01:15:10
  • Last modified 13.05.2025 18:17:51

A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML...

6.1

CVE-2022-42110

  • EPSS 0.2%
  • Published 15.11.2022 00:15:12
  • Last modified 13.05.2025 18:17:51

A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary we...

5.4

CVE-2022-38901

Exploit
  • EPSS 0.28%
  • Published 19.10.2022 02:15:09
  • Last modified 09.05.2025 15:15:53

A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uplo...

5.4

CVE-2022-42112

  • EPSS 0.2%
  • Published 18.10.2022 21:15:16
  • Last modified 13.05.2025 18:17:51

A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject...