Liferay

Digital Experience Platform

121 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2021-38263

  • EPSS 0.53%
  • Published 03.03.2022 00:15:07
  • Last modified 21.11.2024 06:16:41

Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary...

7.5

CVE-2021-38266

  • EPSS 1.85%
  • Published 02.03.2022 23:15:08
  • Last modified 21.11.2024 06:16:42

The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate ...

6.5

CVE-2021-38268

  • EPSS 0.12%
  • Published 02.03.2022 19:15:07
  • Last modified 21.11.2024 06:16:42

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allo...

6.1

CVE-2021-33337

  • EPSS 0.26%
  • Published 04.08.2021 14:15:08
  • Last modified 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web scri...

7.5

CVE-2021-33338

  • EPSS 0.11%
  • Published 04.08.2021 14:15:08
  • Last modified 13.05.2025 18:17:51

The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Fo...

5.4

CVE-2021-33336

  • EPSS 0.17%
  • Published 04.08.2021 13:15:08
  • Last modified 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via...

4.8

CVE-2021-33339

  • EPSS 0.17%
  • Published 04.08.2021 13:15:08
  • Last modified 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_Si...

7.2

CVE-2021-33335

  • EPSS 0.63%
  • Published 03.08.2021 22:15:09
  • Last modified 13.05.2025 18:17:51

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator us...

6.1

CVE-2021-33331

  • EPSS 0.36%
  • Published 03.08.2021 21:15:08
  • Last modified 13.05.2025 18:17:51

Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external U...

6.1

CVE-2021-33332

  • EPSS 0.24%
  • Published 03.08.2021 21:15:08
  • Last modified 13.05.2025 18:17:51

Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via ...