CVE-2021-29044

Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...

CVE-2021-29053

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1 CommerceChannelRelFinder.countByCC, or 2 CommerceChannelRelFinder.findByCC...

CVE-2021-29046

Cross-site scripting XSS vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the comliferayassetcategoriesadminwebportletAssetCategoriesAdminPortlettitle...

CVE-2021-29044

Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...

CVE-2021-29053

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1 CommerceChannelRelFinder.countByCC, or 2 CommerceChannelRelFinder.findByCC...

Cross site scripting

Cross-site scripting XSS vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the comliferayassetcategoriesadminwebportletAssetCategoriesAdminPortlettitle...

CVE-2021-29051

CVE-2021-29051 affects Liferay Portal/DXP: Asset Publisher app vulnerable to XSS via _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter. Affected: Portal 7.2.1–7.3.5; DXP 7.1 before FP21, 7.2 before FP10, and 7.3 before FP1. Root cause: inp...

CVE-2021-29044

Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...

CVE-2021-29044

Summary (CVE-2021-29044) : This XSS vulnerability affects Liferay Portal 7.0.0–7.3.5 and Liferay DXP 7.0–7.3 with various fix-pack gaps. The issue is an input136 via the parameter _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments in the Site module membership request administration p...

CVE-2021-29043

The CVE-2021-29043 issue affects Liferay Portal/DXP: Portal Store module versions 7.0.0–7.3.5 (and Liferay DXP 7.0 prior to fix pack 97, 7.1 prior to fix pack 21, 7.2 prior to fix pack 10, 7.3 prior to fix pack 1) do not obfuscate the S3 store proxy password. This enables an attacker to harvest t...

CVE-2021-29053

CVE-2021-29053 affects Liferay Portal 7.3.5 and Liferay DXP 7.3 (before fix pack 1). The vulnerability is SQL injection in CommerceChannelRelFinder.countByC_C and CommerceChannelRelFinder.findByC_C via the classPKField parameter, allowing remote authenticated users to execute arbitrary SQL comman...

CVE-2021-29046

The CVE-2021-29046 issue affects Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1. It is a cross-site scripting (XSS) vulnerability in the Asset module’s category selector input field, exploitable via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title ...

CVE-2021-29045

Cross-site scripting XSS vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

CVE-2021-29045

The CVE describes a cross-site scripting (XSS) vulnerability in the Redirect module’s redirection administration page of Liferay Portal 7.3.2–7.3.5 and Liferay DXP 7.3 before fix pack 1. The issue arises from improper validation of the _com_liferay_redirect_web_internal_portlet_RedirectPortlet_de...

PT-2021-18048

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.1 through 7.3.5 Liferay DXP versions 7.1 before fix pack 21 Liferay DXP versions 7.2 before fix pack 10 Liferay DXP versions 7.3 before fix pack 1 Description: A cross-site scripting XSS issue exists in the Asset...

PT-2021-18041

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.0.0 through 7.3.5 Liferay DXP 7.0 before fix pack 97 Liferay DXP 7.1 before fix pack 21 Liferay DXP 7.2 before fix pack 10 Liferay DXP 7.3 before fix pack 1 Description: The Portal Store module does not obfuscate the...

PT-2021-18049

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.0 through 7.3.5 Liferay DXP 7.3 before fix pack 1 Description: The issue concerns the Data Engine module, which fails to check permissions in...

PT-2021-18050

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.5 and earlier Liferay DXP versions 7.3 before fix pack 1 Description: The issue allows remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1...

CVE-2021-29053: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1 CommerceChannelRelFinder.countByCC, or 2 CommerceChannelRelFinder.findByCC...

CVE-2021-29044: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...