GHSA-67JP-27JJ-6X85 Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module

A Cross-site scripting XSS vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Frontend Editor CKEditor Web before 5.0.46 from Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject...

GHSA-CMRW-CGFC-V6X2 Liferay Portal and Liferay DXP Vulnerable to XSS via the Role Module

A Cross-site scripting XSS vulnerability in the Role module's edit role assignees page in Liferay Roles Admin Web before 5.0.48 from Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML...

Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module

A Cross-site scripting XSS vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Frontend Editor CKEditor Web before 5.0.46 from Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject...

Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module

A Cross-site scripting XSS vulnerability in Document Library module before 6.0.98 from Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

GHSA-R32W-V775-5952 Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module

A Cross-site scripting XSS vulnerability in Document Library module before 6.0.98 from Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

Liferay Portal and Liferay DXP Vulnerable to XSS via the Role Module

A Cross-site scripting XSS vulnerability in the Role module's edit role assignees page in Liferay Roles Admin Web before 5.0.48 from Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML...

GHSA-7F7G-VHFF-MJQJ Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

A Cross-site scripting XSS vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via...

GHSA-G6R2-6X46-JPP6 Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module

A Cross-site scripting XSS vulnerability in the Frontend Taglib module before 9.1.7 from Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML...

CVE-2022-38901

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

CVE-2022-42112

A Cross-site scripting XSS vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted paylo...

CVE-2022-42117

A Cross-site scripting XSS vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML...

Cross site scripting

A Cross-site scripting XSS vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted paylo...

Cross site scripting

A Cross-site scripting XSS vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the 1 name, or 2 namespace...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...

CVE-2022-42113

A Cross-site scripting XSS vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter...

CVE-2022-42114

A Cross-site scripting XSS vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML...

CVE-2022-42116

CVE-2022-42116 is an XSS vulnerability in Liferay Portal/Liferay DXP where the Frontend Editor module’s CKEditor integration accepts user-controlled input via the name or namespace parameters. Affected versions include Liferay Portal 7.3.2 through 7.4.3.14 and Liferay DXP 7.3 before update 6 and ...

PT-2022-26262 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.2 through 7.4.3.16 Liferay DXP versions 7.3 before update 6, and 7.4 before update 17 Description: A Cross-site scripting XSS issue in the Frontend Taglib module allows remote attackers to inject arbitrary web scri...

CVE-2022-42113

CVE-2022-42113 is a documented XSS vulnerability in the Document Library module affecting Liferay Portal 7.4.3.30–7.4.3.36 and Liferay DXP 7.4 update 30–36. The issue allows remote attackers to inject arbitrary web script or HTML via the redirect parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:...

CVE-2022-42116: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14, and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the 1 name, or 2 namespace...