Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the calendar implementation. An attacker can obtain access to other users' calendars and their names by sending crafted requests, which may enable further targeted attacks such as phishing. Remediation Upgrade...

Cross-Site Scripting (XSS)

com.liferay.calendar.web is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript code in a user's browser via the username, lastname and surname fields from profile page...