Liferay Portal CE 7.4.3.70 < 7.4.3.74 XSS

The detected install of Liferay Portal CE is between 7.4.3.70 and 7.4.3.73. It is therefore affected by a Cross-site scripting XSS vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, which allows remote attackers to inject arbitrary web script or HT...

CVE-2020-7934

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload wi...

PT-2020-19856

Name of the Vulnerable Software and Affected Versions Liferay Portal CE versions 7.1.0 through 7.2.1 GA2 Description The First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are vulnerable to a persistent XSS issue. Any user can modify these fields with a particular...

CVE-2020-7934: Improper Neutralization of Input During Web Page Generation

In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload wi...

CVE-2019-16891: Deserialization of Untrusted Data

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload...

CVE-2019-16891

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload...

CVE-2019-11444

An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a command.execute call, as demonstrated by "def cmd =" in the ServerAdminPortletscript value to group/controlpanel/manage. Valid...

CVE-2019-11444

Affected software: Liferay Portal CE 7.1.2 GA3. Issue: Groovy script console allows OS command execution via a command.execute() call (def cmd = ...) in ServerAdminPortlet_script. Exploitation requires valid application administrator credentials. Impact: remote command execution with high severit...

CVE-2019-11444: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a command.execute call, as demonstrated by "def cmd =" in the ServerAdminPortletscript value to group/controlpanel/manage. Valid...

CVE-2017-1000425

Cross-site scripting XSS vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter...

CVE-2017-1000425

Cross-site scripting XSS vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter...

CVE-2017-1000425: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter...

PT-2018-5200

Name of the Vulnerable Software and Affected Versions Liferay Portal CE versions prior to 7.0 GA4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via a javascript: URI in the movie parameter in the "/html/portal/flash.jsp" page...