CVE-2020-28884

Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groo...

Liferay Enterprise Portal 跨站脚本漏洞

Liferay Enterprise Portal is an application system from Liferay USA. It provides a showcase for e-commerce functionality. A cross-site scripting vulnerability exists in Liferay Enterprise Portal. The vulnerability stems from insufficient handling of user-supplied data in the administration page o...