409 matches found
CVE-2024-55554
Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet...
CVE-2023-47321
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...
CVE-2022-27197
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views...
CVE-2011-1503
The XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary 1 XSL and 2 XML files via a file:/// URL...
CVE-2008-0182
Cross-site request forgery CSRF vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdown message...
CVE-2024-55554
Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet...
CVE-2024-55554
Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet. Affected component: portal server web UI; root cause: input in portlet not properly sanitized. Impact: cross-site scripting with network access, requiring user interaction; CVSSv3.1 base score 5.4 (MEDIUM). Remediation: up...
CVE-2024-55554
Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet...
PT-2024-21326 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.103 Liferay DXP versions 2023.Q4.0 through 2023.Q4.2 Liferay DXP versions 2023.Q3.1 through 2023.Q3.5 Liferay DXP versions 7.4 GA through update 92 Liferay DXP versions 7.3 update 29 through update ...
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System...
CVE-2024-3164
The CVE-2024-3164 issue affects dotCMS where the Tools and Log Files tabs under System → Maintenance Portlet are accessible to any user with the portlet, not just CMS Admins. The vulnerability arises from broken access control, allowing site-admin users (without system-admin privileges) to access...
dotCMS 安全漏洞
DotCMS is an open source content management system written in Java by DotCMS, Inc. for managing content and content-driven sites and applications. A security vulnerability exists in dotCMS that stems from the fact that any user with portlet privileges can access the Tools and Log Files tabs under...
PT-2024-24172 · Dotcms · Dotcms
Name of the Vulnerable Software and Affected Versions: dotCMS version 22.02 Description: The issue concerns the dotCMS dashboard, specifically the Tools and Log Files tabs under System → Maintenance Portlet. This portlet, which is intended for Admin access, is accessible to anyone with the portle...
Liferay Portal and Liferay DXP Security Vulnerabilities
Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...
Liferay DXP Security Vulnerability
Liferay DXP is a suite of digital experience collaboration platforms from Liferay USA. A security vulnerability exists in Liferay DXP that stems from an open redirection vulnerability that allows remote attackers to redirect users to arbitrary external URLs via the...
PT-2024-13048 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.3 through 7.4.3.97 Liferay DXP 2023.Q3 before patch 6 Liferay DXP 7.4 GA through update 92 Liferay DXP 7.3 before update 34 Description: A reflected cross-site scripting XSS issue exists on the add assignees to a...
PT-2024-21322 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.37 Liferay DXP versions prior to 7.4 update 38 Liferay DXP versions prior to 7.3 update 11 Liferay DXP versions prior to 7.2 fix pack 20 Description: A cross-site scripting XSS issue in the Frontend...
GHSA-28WG-8GV4-MPJF Broken access control in Silverpeas
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...
Broken access control in Silverpeas
Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...