CVE-2022-28977
- EPSS 0.4%
- Veröffentlicht 22.09.2022 01:15:10
- Zuletzt bearbeitet 27.05.2025 16:15:22
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, wh...
CVE-2022-39975
- EPSS 0.16%
- Veröffentlicht 22.09.2022 00:15:10
- Zuletzt bearbeitet 27.05.2025 19:15:22
The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublish...
CVE-2022-28978
- EPSS 0.1%
- Veröffentlicht 22.09.2022 00:15:09
- Zuletzt bearbeitet 27.05.2025 19:15:21
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before se...
CVE-2022-28979
- EPSS 0.47%
- Veröffentlicht 22.09.2022 00:15:09
- Zuletzt bearbeitet 27.05.2025 20:15:22
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget....
CVE-2022-28982
- EPSS 0.4%
- Veröffentlicht 22.09.2022 00:15:09
- Zuletzt bearbeitet 27.05.2025 18:15:28
A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
CVE-2021-33321
- EPSS 0.31%
- Veröffentlicht 03.08.2021 19:15:08
- Zuletzt bearbeitet 21.11.2024 06:08:41
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should b...
CVE-2021-29049
- EPSS 0.28%
- Veröffentlicht 09.06.2021 19:15:09
- Zuletzt bearbeitet 13.05.2025 18:17:51
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1 before fix pack 23, 7.2 before fix pack 12 and 7.3 before fix pack 1, allows remote attackers to inject arbitrary we...
CVE-2021-29048
- EPSS 0.26%
- Veröffentlicht 17.05.2021 12:15:07
- Zuletzt bearbeitet 13.05.2025 18:17:51
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML vi...
CVE-2021-29051
- EPSS 0.23%
- Veröffentlicht 17.05.2021 12:15:07
- Zuletzt bearbeitet 13.05.2025 18:17:51
Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbit...
CVE-2021-29052
- EPSS 0.08%
- Veröffentlicht 17.05.2021 12:15:07
- Zuletzt bearbeitet 21.11.2024 06:00:36
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated user...