Lucene search

K
LiferayLiferay Portal

32 matches found

CVE
CVE
added 2021/08/03 10:15 p.m.93 views

CVE-2021-33335

Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator u...

7.2CVSS6.8AI score0.00634EPSS
CVE
CVE
added 2021/05/16 4:15 p.m.87 views

CVE-2021-29040

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused at...

5.3CVSS5.2AI score0.00218EPSS
CVE
CVE
added 2021/08/04 2:15 p.m.85 views

CVE-2021-33338

The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF token in URLs, which allows man-in-the-middle attackers to obtain the token and conduct Cross-Site Request Forgery (CSRF) attacks via the p_auth parameter.

7.5CVSS7.5AI score0.0011EPSS
CVE
CVE
added 2021/08/03 9:15 p.m.83 views

CVE-2021-33333

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs.

6.5CVSS6AI score0.00285EPSS
CVE
CVE
added 2021/05/17 11:15 a.m.82 views

CVE-2021-29043

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle ...

5.9CVSS5.8AI score0.00204EPSS
CVE
CVE
added 2021/08/04 2:15 p.m.79 views

CVE-2021-35463

Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the keywords parameter.

6.1CVSS5.9AI score0.00249EPSS
CVE
CVE
added 2021/08/04 2:15 p.m.74 views

CVE-2021-33337

Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_...

6.1CVSS6AI score0.00258EPSS
CVE
CVE
added 2021/08/04 1:15 p.m.73 views

CVE-2021-33339

Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_admin_web_portlet_SiteAdminPortlet_name parameter.

4.8CVSS5AI score0.00172EPSS
CVE
CVE
added 2021/08/03 9:15 p.m.72 views

CVE-2021-33331

Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter.

6.1CVSS6.3AI score0.00356EPSS
CVE
CVE
added 2021/05/17 11:15 a.m.71 views

CVE-2021-29044

Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...

6.1CVSS6AI score0.00257EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.70 views

CVE-2021-33326

Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.

6.1CVSS6AI score0.00418EPSS
CVE
CVE
added 2021/08/03 9:15 p.m.68 views

CVE-2021-33334

The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view...

4.3CVSS4.5AI score0.00081EPSS
CVE
CVE
added 2021/08/04 1:15 p.m.68 views

CVE-2021-33336

Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_journal_web_portlet_JournalPort...

5.4CVSS5.3AI score0.00167EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.66 views

CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset token...

7.5CVSS7.6AI score0.00223EPSS
CVE
CVE
added 2021/05/17 11:15 a.m.57 views

CVE-2021-29053

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C.

8.8CVSS9.1AI score0.00375EPSS
CVE
CVE
added 2021/08/03 9:15 p.m.57 views

CVE-2021-33332

Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portlet_configuration_css_web_po...

6.1CVSS6AI score0.00244EPSS
CVE
CVE
added 2021/05/16 4:15 p.m.55 views

CVE-2021-29047

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.

7.5CVSS7.5AI score0.00212EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.54 views

CVE-2021-33320

The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emai...

4.3CVSS4.3AI score0.00392EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.52 views

CVE-2021-33321

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true.

7.5CVSS7.6AI score0.00313EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.51 views

CVE-2021-33324

The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a page to view the page via a site's page administration.

4.3CVSS4.3AI score0.00121EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.51 views

CVE-2021-33325

The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 before fix pack 7, user's clear text passwords are stored in the database if workflow is enabled for user creation, which allows attackers with access to the datab...

4.9CVSS4.9AI score0.00123EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.51 views

CVE-2021-33328

Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_lifer...

5.4CVSS5.3AI score0.00148EPSS
CVE
CVE
added 2021/05/16 3:15 p.m.50 views

CVE-2021-29039

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.

6.1CVSS6AI score0.00257EPSS
CVE
CVE
added 2021/05/17 12:15 p.m.50 views

CVE-2021-29048

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 before fix pack 11 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_layout_admin_web_portlet_Group...

6.1CVSS6AI score0.00257EPSS
CVE
CVE
added 2021/05/17 12:15 p.m.50 views

CVE-2021-29051

Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asse...

6.1CVSS6AI score0.00233EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.50 views

CVE-2021-33330

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the...

4.3CVSS4.3AI score0.00207EPSS
CVE
CVE
added 2021/05/17 12:15 p.m.48 views

CVE-2021-29052

The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls.

4.3CVSS4.3AI score0.00077EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.47 views

CVE-2021-33327

The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility"...

4.3CVSS4.3AI score0.00106EPSS
CVE
CVE
added 2021/08/03 7:15 p.m.46 views

CVE-2021-33323

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, autosaves form values for unauthenticated users, which allows remote attackers to view the autosaved values by viewing the form as an unauthenticated user.

7.5CVSS7.6AI score0.00417EPSS
CVE
CVE
added 2021/01/07 5:15 p.m.45 views

CVE-2020-25476

Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected...

6.1CVSS6.2AI score0.0045EPSS
CVE
CVE
added 2021/05/17 11:15 a.m.39 views

CVE-2021-29045

Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_redirect_web_internal_portlet_RedirectPo...

6.1CVSS6AI score0.00278EPSS
CVE
CVE
added 2021/05/17 11:15 a.m.39 views

CVE-2021-29046

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPort...

6.1CVSS6AI score0.00257EPSS