CVE-2023-3193
- EPSS 0.14%
- Veröffentlicht 15.06.2023 04:15:34
- Zuletzt bearbeitet 21.11.2024 08:16:39
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_lifer...
CVE-2022-42118
- EPSS 33.29%
- Veröffentlicht 15.11.2022 01:15:12
- Zuletzt bearbeitet 13.05.2025 18:17:51
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary we...
CVE-2022-42119
- EPSS 0.52%
- Veröffentlicht 15.11.2022 01:15:12
- Zuletzt bearbeitet 30.04.2025 15:15:55
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8.
CVE-2022-42120
- EPSS 0.3%
- Veröffentlicht 15.11.2022 01:15:12
- Zuletzt bearbeitet 05.09.2025 18:15:36
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attr...
CVE-2022-42121
- EPSS 0.46%
- Veröffentlicht 15.11.2022 01:15:12
- Zuletzt bearbeitet 05.09.2025 18:15:36
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitra...
CVE-2022-42122
- EPSS 0.3%
- Veröffentlicht 15.11.2022 01:15:12
- Zuletzt bearbeitet 05.09.2025 18:15:36
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly U...
CVE-2022-42111
- EPSS 0.14%
- Veröffentlicht 15.11.2022 01:15:10
- Zuletzt bearbeitet 13.05.2025 18:17:51
A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML...
CVE-2022-42110
- EPSS 0.2%
- Veröffentlicht 15.11.2022 00:15:12
- Zuletzt bearbeitet 13.05.2025 18:17:51
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary we...
CVE-2022-38901
- EPSS 0.28%
- Veröffentlicht 19.10.2022 02:15:09
- Zuletzt bearbeitet 09.05.2025 15:15:53
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uplo...
CVE-2022-42112
- EPSS 0.2%
- Veröffentlicht 18.10.2022 21:15:16
- Zuletzt bearbeitet 13.05.2025 18:17:51
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject...