Liferay Portal 和 Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

CVE-2021-31927

An Insecure Direct Object Reference IDOR vulnerability in Annex Cloud Loyalty Experience Platform 2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2...

CVE-2021-31927

An Insecure Direct Object Reference IDOR vulnerability in Annex Cloud Loyalty Experience Platform 2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2...

Design/Logic Flaw

Annex Cloud Loyalty Experience Platform 2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator. It was fixed in v2021.1.0.2...

CVE-2021-31927

CVE-2021-31927 describes an Insecure Direct Object Reference (IDOR) in Annex Cloud Loyalty Experience Platform versions earlier than 2021.1.0.1, allowing any authenticated user to modify existing users across environments/clients. The issue is fixed in 2021.1.0.2. Affected component: Annex Cloud ...

CVE-2021-31928

CVE-2021-31928 affects Annex Cloud Loyalty Experience Platform versions prior to 2021.1.0.1. An authenticated attacker can escalate privileges to superadministrator. The issue was fixed in v2021.1.0.2. The CVSS metrics listed (NVD) indicate high impact with full confidentiality, integrity, and av...

CVE-2021-31929

The vulnerability CVE-2021-31929 affects Annex Cloud’s Loyalty Experience Platform before version 2021.1.0.1. An authenticated attacker can modify loyalty campaigns and settings (including fraud prevention, coupon groups, email templates, and referrals), indicating insufficient authorization cont...

Annex Cloud Loyalty Experience Platform 安全漏洞

Loyalty Experience Platform is Annex Cloud's platform that combines best-in-class program management capabilities with powerful engagement modules A security vulnerability exists in Annex Cloud Loyalty Experience Platform versions prior to 2021.1.0.1 that can be exploited by an attacker to escala...

CVE-2021-29044

Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...

Liferay Portal 安全漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses EJB as well as JMS and other technologies , and can be used as a Web publishing and sharing workspaces , enterprise collaboration platforms , social networks and so on. A security vulnerability exists in Liferay...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platforms, social networks and more. A cross-site scripting vulnerability exists in Lifer...

CVE-2021-27931

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service...

CVE-2021-27931

LumisXP

CVE-2020-26246

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

Code injection

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

CVE-2020-26246

Pimcore prior to version 6.8.5 is vulnerable to an authorization bypass that allows modifying and creating website settings without proper permissions. The issue stems from insufficient access rights enforcement, enabling an unauthorised user to alter settings, redirects, and asset metadata. Affe...

CVE-2020-26246 Authorization bypass in Pimcore

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions...

Sitecore Experience Platform Command Injection Vulnerability

Sitecore XP is a suite of customer digital experience platforms from Sitecore Denmark. A command injection vulnerability exists in Sitecore Experience Platform XP versions prior to 9.1.1. The vulnerability arises from a network system or product not properly filtering specific elements of...

PT-2019-19908 · Sitecore · Sitecore Xp +2

Name of the Vulnerable Software and Affected Versions: Sitecore CMS versions 7.0 through 7.2 Sitecore XP versions 7.5 through 8.2 Description: The deserialization of untrusted data in the Sitecore.Security.AntiCSRF module allows an unauthenticated attacker to execute arbitrary code by sending a...

CVE-2016-8855

Cross-Site Scripting XSS in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 8.1 Update-3 allows remote attacks via the Name or Description parameter. This is fixed in 8.2 Update-2...