CVE-2022-38512: Missing Authorization

The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL...

CVE-2022-28982

A cross-site scripting XSS vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag...

CVE-2022-28982

Summary: CVE-2022-28982 is an XSS vulnerability in Liferay Portal 7.3.3–7.4.2 and Liferay DXP 7.3 before Service Pack 3. The flaw allows an attacker to inject a crafted payload into a tag name, enabling arbitrary web scripts/HTML execution on the client side. Affected products/components: Liferay...

CVE-2022-28982

A cross-site scripting XSS vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag...

CVE-2022-28978

The CVE-2022-28978 entry describes a stored XSS vulnerability in the Site module’s user membership administration page of Liferay Portal 7.0.1–7.4.1 and Liferay DXP 7.0 (before fix pack 102), 7.1 (before fix pack 26), 7.2 (before fix pack 15), and 7.3 (before service pack 3). Affects the ability ...

CVE-2022-28978

Stored cross-site scripting XSS vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject...

CVE-2022-39975

The CVE-2022-39975 issue affects Liferay Portal 7.3.3–7.4.3.34 and Liferay DXP 7.3 (pre-update 10) and 7.4 (pre-update 35). The root cause is missing authorization when previewing a Content Page, enabling an attacker to view unpublished Content Pages via URL manipulation. Exploitation details are...

CVE-2022-28979

CVE-2022-28979 is an XSS vulnerability in the Portal Search module’s Custom Facet widget affecting Liferay Portal 7.1.0–7.4.2 and Liferay DXP 7.1 (before fix pack 26), 7.2 (before fix pack 15), and 7.3 (before service pack 3). The issue arises from the Custom Parameter Name field in the widget, a...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

多款 Liferay 产品 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

PT-2022-19342 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.3 through 7.4.2 Liferay DXP versions 7.3 before service pack 3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of...

Malicious code in amex-eapply-dxp-component-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ffe490b75b611f35ad4950884acd2611d2fd1835b07784611dc51f8d36baea8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-964 Malicious code in amex-eapply-dxp-component-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ffe490b75b611f35ad4950884acd2611d2fd1835b07784611dc51f8d36baea8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-2X4V-G8CX-JXRQ Login timing attack in ibexa/core

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

Login timing attack in ezsystems/ezpublish-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

GHSA-XFQG-P48G-HH94 Login timing attack in ezsystems/ezpublish-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

GHSA-342C-VCFF-2FF2 Login timing attack in ezsystems/ezplatform-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

Login timing attack in ezsystems/ezplatform-kernel

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...