1641 matches found
CVE-2022-42122: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the title field of a friendly URL...
CVE-2022-42128
CVE-2022-42128 affects Liferay Portal 7.4.1–7.4.3.4 and Liferay DXP 7.4 GA. The Hypermedia REST APIs module fails to properly enforce permissions, allowing remote attackers to obtain a WikiNode object through WikiNodeResource.getSiteWikiNodeByExternalReferenceCode. Impact is information disclosur...
CVE-2022-42132: Exposure of Sensitive Information to an Unauthorized Actor
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, whic...
CVE-2022-42119: Improper Neutralization of Input During Web Page Generation
Certain Liferay products are vulnerable to Cross Site Scripting XSS via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP 7.3 before update 8...
CVE-2022-42127
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page...
CVE-2022-42118
The CVE-2022-42118 XSS flaw affects Liferay Portal 7.1.0–7.4.2 and Liferay DXP 7.1 (before fix pack 27), 7.2 (before fix pack 15), and 7.3 (before service pack 3) in the Portal Search module via the tag parameter. Exploitation can inject arbitrary script/HTML, potentially stealing credentials or ...
CVE-2022-42127
CVE-2022-42127 affects Liferay Portal 7.4.3.5–7.4.3.36 and Liferay DXP 7.4 update 1–36, via the Friendly Url module. Root cause: insufficient permission checks allow remote attackers to obtain the history of all friendly URLs assigned to a page. Public exploit details are not provided in the docu...
CVE-2022-42124
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected in...
CVE-2022-42123: Improper Limitation of a Pathname to a Restricted Directory
A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin...
CVE-2022-42132
CVE-2022-42132 concerns information disclosure in Liferay Portal (7.0.0–7.4.3.4) and Liferay DXP (various fix pack/update levels) where the LDAP credential is included in the page URL during pagination of the user list. This exposes credentials to MITM attackers or anyone with access to request l...
CVE-2022-42125
CVE-2022-42125 is a Zip slip vulnerability in Liferay’s FileUtil.unzip affecting Liferay Portal 7.4.3.5–7.4.3.35 and Liferay DXP 7.4 update 1–34. The issue allows an attacker to create or overwrite files on the filesystem by deploying a malicious plugin/module. Root cause: Zip slip in FileUtil.un...
CVE-2022-42125
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module...
CVE-2022-42125: Improper Limitation of a Pathname to a Restricted Directory
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module...
CVE-2022-42126
The CVE-2022-42126 entry affects the Asset Libraries module in Liferay Portal 7.3.5–7.4.3.28 and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29. Root cause: improper permission checks allow remote authenticated users to view asset libraries via the UI. Practical impact is exposure ...
CVE-2022-42131
Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3...
CVE-2022-42111: Improper Neutralization of Input During Web Page Generation
A Cross-site scripting XSS vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload...
CVE-2022-42122
CVE-2022-42122 affects Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4, via the Friendly Url module. The vulnerability is an SQL injection in the title field of a friendly URL, allowing arbitrary SQL execution. The CVSS 3.1 base score is 9.8 (CRITICAL) with NETWORK attack vec...
CVE-2022-42121
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected...
CVE-2022-42131: Improper Certificate Validation
Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3...