Directory traversal

Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle...

CVE-2023-27067

Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx...

Sitecore Experience Platform 路径遍历漏洞

Sitecore Experience Platform XP is a suite of customer digital experience platforms from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Platform 10.2 and prior versions, which stems from a directory traversal vulnerability that could allow an authenticated, remote...

Sitecore Experience Platform 路径遍历漏洞

Sitecore Experience Platform XP is a suite of customer digital experience platforms from Sitecore, Denmark. A security vulnerability exists in Sitecore Experience Platform 10.2 and prior versions, which stems from a directory traversal vulnerability that allows remote attackers to download...

CVE-2023-27066

Directory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrary files via Urlhandle...

CVE-2023-27067

Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx...

PT-2023-20929 · Sitecore · Sitecore Experience Platform

Name of the Vulnerable Software and Affected Versions: Sitecore Experience Platform versions prior to 10.2 Description: The issue allows remote attackers to download arbitrary files via a crafted command to the "download.aspx" endpoint. This is achieved by exploiting a Directory Traversal...

PT-2023-20928 · Sitecore · Sitecore Experience Platform

Name of the Vulnerable Software and Affected Versions: Site Core Experience Platform versions 10.2 and earlier Description: The issue allows authenticated remote attackers to download arbitrary files via Urlhandle. This is a Directory Traversal vulnerability. Recommendations: For Site Core...

CVE-2023-27067

Sitecore Experience Platform (Sitecore XP) versions prior to 10.2 are affected by CVE-2023-27067. The vulnerability is a directory traversal in the download.aspx endpoint that could allow remote attackers to download arbitrary files. Impact is high on confidentiality (C:H) with no integrity or av...

CVE-2023-27066

CVE-2023-27066 affects Sitecore Experience Platform versions 10.2 and earlier. A directory traversal vulnerability allows authenticated remote attackers (low privileges) to download arbitrary files via Urlhandle. Base CVSS v3.1: 6.5 (MEDIUM); attack vector NETWORK, authentication required LOW, pa...

CVE-2022-42120

A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' namespace attribute...

Cross site scripting

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

CVE-2022-38901

A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...

CVE-2022-38901

Summary (CVE-2022-38901, related entries): Liferay Digital Experience Platform 7.3.10 SP3 is affected in the Document and Media module file upload path. The vulnerability is a Cross-site Scripting (XSS) flaw in the description field of uploaded SVG files, enabling remote attackers to inject arbit...

PT-2022-24614 · Liferay · Liferay Digital Experience Platform

Name of the Vulnerable Software and Affected Versions: Liferay Digital Experience Platform version 7.3.10 SP3 Description: A Cross-site scripting XSS issue exists in the file upload functionality of the Document and Media module, allowing remote attackers to inject arbitrary JS script or HTML int...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. A security vulnerability exists in Liferay Portal versions...

Cross site scripting

A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...

CVE-2022-38902

A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...

CVE-2022-38902

Summary (CVE-2022-38902) : In Liferay Digital Experience Platform (DXP) 7.3.10 SP3, a Cross-site Scripting (XSS) vulnerability exists in the Blog module’s add-topic flow. The issue allows remote attackers to inject arbitrary JavaScript or HTML via the name field when creating a new topic. Affecte...

PT-2022-24615 · Liferay · Liferay Digital Experience Platform

Name of the Vulnerable Software and Affected Versions: Liferay Digital Experience Platform version 7.3.10 SP3 Description: A Cross-site scripting XSS issue in the Blog module's add new topic functionality allows remote attackers to inject arbitrary JS script or HTML into the name field of newly...