com.liferay.portal:release.portal.bom (Maven)
Advisories
161
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 7.4.3.132 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>com.liferay.portal</groupId><artifactId>release.portal.bom</artifactId><version>7.4.3.132</version></dependency>gradle
implementation("com.liferay.portal:release.portal.bom:7.4.3.132")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-2j97-4jmq-c4xf Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter |
Medium EPSS 0.24% |
>= 7.4.3.8, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget |
Medium EPSS 0.22% |
>= 7.4.0-ga1, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks |
Medium EPSS 0.23% |
>= 7.4.0-ga1, < 7.4.3.110 | 7.4.3.110 |
| GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration |
Medium EPSS 0.39% |
>= 7.4.0-ga1, < 7.4.3.120 | 7.4.3.120 |
| GHSA-gv7w-jh8g-vr73 Liferay Portal Does Not Limit Access to APIs Before Email Verification |
Medium EPSS 0.22% |
>= 7.4.0-ga1, < 7.4.3.110 | 7.4.3.110 |
| GHSA-gh4w-8qgq-8w9r Liferay Portal Vulnerable to CSRF in Headless APIs |
Medium EPSS 0.18% |
>= 7.4.0-ga1, < 7.4.3.108 | 7.4.3.108 |
| GHSA-xcj6-xpjg-c4xr Liferay Portal Stores Password Reset Tokens in Plain Text |
Medium EPSS 0.29% |
>= 7.4.0-ga1, < 7.4.3.100 | 7.4.3.100 |
| GHSA-vgqx-447m-wvcj Liferay Portal Vulnerable to DoS via Crafted Headless API Request |
High EPSS 0.39% |
>= 7.4.0-ga1, < 7.4.3.100 | 7.4.3.100 |
| GHSA-378f-8q54-3fqx Liferay Portal is vulnerable to Stored XSS through Forms text type field |
Medium EPSS 0.24% |
>= 7.3.2, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-4mqx-4p8g-995w Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page |
Medium EPSS 0.22% |
>= 7.4.3.15, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-xx7h-2wf7-hc7p Liferay Portal is vulnerable to XSS through its Commerce Search Result widget |
Medium EPSS 0.22% |
>= 7.4.0, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-pfxj-gvqg-mj44 Liferay Profile Widget does not prevent vCard extension spoofing |
Medium EPSS 0.24% |
>= 7.4.0-ga1, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-qh92-cr5f-3595 Liferay Portal Vulnerable to XSS in Web Content translation |
Medium EPSS 0.22% |
>= 7.4.0-ga1, < 7.4.3.113-ga113 | 7.4.3.113-ga113 |
| GHSA-m4hg-46pw-6mmv Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter |
Medium EPSS 0.22% |
>= 7.4.3.74-ga74, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-2hm7-r8f3-423h Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet |
High EPSS 0.50% |
>= 7.4.0-ga1, < 7.4.3.108-ga108 | 7.4.3.108-ga108 |
| GHSA-jv8x-mm3v-75r7 Liferay Portal vulnerable to cross-site scripting in the web content template |
Medium EPSS 0.22% |
>= 7.4.3.4-ga4, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-pf86-4w35-cj89 Liferay Portal vulnerable to cross-site scripting in the Calendar widget |
Medium EPSS 0.22% |
>= 7.4.3.35-ga35, < 7.4.3.111-ga111 | 7.4.3.111-ga111 |
| GHSA-43xf-59vr-g4f2 Liferay Portal Uses Default Password |
Medium EPSS 0.26% |
>= 7.4.0, < 7.4.3.112 | 7.4.3.112 |
| GHSA-66x6-8jgv-qpfh Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting |
Medium EPSS 0.22% |
>= 7.4.3.45, < 7.4.3.129 | 7.4.3.129 |
| GHSA-rcc7-jx7p-hrv4 Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting |
Medium EPSS 0.21% |
>= 7.4.0, <= 7.4.3.132 | No fix yet |
| GHSA-fvqv-593q-qp8r Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect |
Medium EPSS 0.26% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-qpp6-f3qj-rggq Liferay Portal's Unlimited File Upload Could Result in DoS |
Medium EPSS 0.33% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-x7p4-v8mj-6fxx Liferay Portal Username Enumeration Vulnerability |
Medium EPSS 0.25% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-q2gv-w583-f2vq Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter |
Medium EPSS 0.22% |
No fix yet | |
| GHSA-62pf-hcwj-rcfc Liferay Portal Vulnerable to Cross-Site Scripting via DDMPortlet_definition Parameter |
Medium EPSS 0.22% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-mpww-r37c-vxjw Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping |
Medium EPSS 0.22% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-p9gc-59hf-x48p Liferay Portal Vulnerable to Cross-Site Request Forgery |
Medium EPSS 0.17% |
>= 7.0.0-a1, < 7.4.3.120-ga120 | 7.4.3.120-ga120 |
| GHSA-5fx5-cff6-f3fp Liferay Portal Unauthenticated File Access via URL |
Medium EPSS 0.26% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-j6p8-g3rj-ghpm Liferay Portal Vulnerable to Cross-Site Scripting via assetTagNames Parameter |
Medium EPSS 0.22% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-m49p-6cjp-x2h3 Liferay Portal Vulnerable to Cross-Site Scripting via DDM Structure Field Labels |
Medium EPSS 0.18% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-g4vp-4gqr-7v8c Liferay Portal Enumeration Discrepancy in Calendars |
Medium EPSS 0.29% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-7q33-gwcm-r6cj Liferay Portal CSRF Vulnerability via Endpoint Parameter |
Medium EPSS 0.25% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-22jp-w3cg-gvmm Liferay Portal has Stored Cross-Site Scripting Vulnerability via Message Boards Feature |
Medium EPSS 0.22% |
>= 7.4.3.120-ga120, <= 7.4.3.132-ga23 | No fix yet |
| GHSA-3p2m-574v-v257 Liferay Portal Vulnerable to Cross-Site Scripting |
Medium EPSS 0.22% |
>= 7.4.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-g4wg-mpfg-x2q6 Liferay Portal Login Bypass Vulnerability |
Low EPSS 0.50% |
>= 7.3.0-ga1, <= 7.4.3.132-ga132 | No fix yet |
| GHSA-m5c7-5gv3-hcpf Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability |
Medium EPSS 0.22% |
>= 7.4.0, <= 7.4.3.132 | No fix yet |
| GHSA-222w-xmc5-jhp3 Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability |
Medium EPSS 0.22% |
>= 7.4.0, < 7.4.3.132 | 7.4.3.132 |
| GHSA-cg99-m88x-422c Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability |
Medium EPSS 0.29% |
>= 7.4.3.0, <= 7.4.3.132 | No fix yet |
| GHSA-c6g5-g6r7-q4j6 Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery |
Medium EPSS 0.25% |
>= 7.4.0, <= 7.4.3.132 | No fix yet |
| GHSA-6v93-frf9-2rp8 Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery |
High EPSS 0.47% |
>= 7.4.0, <= 7.4.3.132 | No fix yet |
| GHSA-qhp6-vp7c-g7xp Liferay Cross-site Scripting vulnerability |
Medium EPSS 0.27% |
>= 7.2.0, < 7.4.3.132 | 7.4.3.132 |
| GHSA-9fcg-wrp8-qhr4 Liferay Portal and Liferay DXP Reveals Data via Forms |
Medium EPSS 0.27% |
>= 7.4.0, < 7.4.3.129 | 7.4.3.129 |
| GHSA-hrc4-p2h3-pjqw Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) |
Medium EPSS 0.29% |
>= 7.4.3.82, < 7.4.3.129 | 7.4.3.129 |
| GHSA-px38-239g-x5mg Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page |
Medium EPSS 0.28% |
>= 7.0.0, < 7.4.3.88 | 7.4.3.88 |
| GHSA-4hxr-28mv-q729 Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting |
Medium EPSS 0.34% |
>= 7.1.0, < 7.4.3.39 | 7.4.3.39 |
| GHSA-chj2-4vg7-hhg3 Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console |
Medium EPSS 0.24% |
>= 7.0.0-a1, < 7.4.3.102-GA102 | 7.4.3.102-GA102 |
| GHSA-3mfq-fp2f-vwqh Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions |
High EPSS 0.65% |
>= 7.3.2-ga3, < 7.4.3.112-ga112 | 7.4.3.112-ga112 |
| GHSA-hmrx-6pr5-hpwj Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor |
High EPSS 0.38% |
>= 7.4.0, < 7.4.3.104 | 7.4.3.104 |
| GHSA-p63m-vmjr-wg37 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor |
High EPSS 0.38% |
>= 7.3.2, < 7.4.3.108 | 7.4.3.108 |
| GHSA-6c4v-x9v2-rjm8 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget |
High EPSS 0.38% |
>= 7.4.3.75, < 7.4.3.112 | 7.4.3.112 |
| GHSA-q2cv-7j58-rfmj Liferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting |
Medium EPSS 0.61% |
>= 7.4.3.18, < 7.4.3.102 | 7.4.3.102 |
| GHSA-hgr6-6hhw-883f Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing |
Medium EPSS 0.47% |
< 7.4.3.4 | 7.4.3.4 |
| GHSA-rwhv-hvj2-qrqm Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting |
Medium EPSS 0.56% |
>= 7.2.0, < 7.4.3.38 | 7.4.3.38 |
| GHSA-rwxc-4cmw-7x75 Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting |
Medium EPSS 0.56% |
< 7.4.3.14 | 7.4.3.14 |
| GHSA-44jg-jgjx-3xg5 Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting |
Medium EPSS 0.56% |
< 7.4.3.5 | 7.4.3.5 |
| GHSA-73x3-8mrg-5r93 Liferay Portal Language Override edit screen and Liferay DXP vulnerable to reflected Cross-site Scripting |
Medium EPSS 0.61% |
>= 7.4.3.8, < 7.4.3.98 | 7.4.3.98 |
| GHSA-54pv-r62j-9qqc Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting |
Medium EPSS 0.61% |
>= 7.3.3, < 7.4.3.98 | 7.4.3.98 |
| GHSA-468x-frcm-ghx6 Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting |
Medium EPSS 0.62% |
>= 7.4.3.44, < 7.4.3.98 | 7.4.3.98 |
| GHSA-v2xq-m22w-jmpr Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting |
Medium EPSS 0.61% |
<= 7.4.2 | No fix yet |
| GHSA-cr36-3vqf-x5w5 Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting |
Medium EPSS 0.56% |
<= 7.4.2 | No fix yet |
| GHSA-p28x-4r5h-ph6j Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting |
Medium EPSS 0.56% |
<= 7.4.2 | No fix yet |
| GHSA-xpjg-7hx7-wgcx Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting |
Medium EPSS 0.56% |
<= 7.4.1 | No fix yet |
| GHSA-xq4r-4xfh-vch8 Liferay Portal and Liferay DXP vulnerable to theft of hashed password |
Medium EPSS 0.44% |
>= 7.4.3.76, < 7.4.3.100 | 7.4.3.100 |
| GHSA-qm43-g2xj-hvg5 Liferay Portal and Liferay DXP User Enumeration Vulnerability |
Medium EPSS 0.53% |
>= 7.2.0, < 7.4.3.27-ga27 | 7.4.3.27-ga27 |
| GHSA-2mvj-q2q3-wxjv Liferay Portal and Liferay DXP HTTP Header Can Expose Versions |
Medium EPSS 0.53% |
>= 7.2.0, < 7.4.3.26-ga26 | 7.4.3.26-ga26 |
| GHSA-29xx-fhff-36m7 Liferay Portal vulnerable to Denial of Service |
Medium EPSS 0.71% |
< 7.4.3.16 | 7.4.3.16 |
| GHSA-vvpf-53qx-cxhh Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) |
Medium EPSS 0.52% |
< 7.4.3.13 | 7.4.3.13 |
| GHSA-3qq5-wcrx-4h8r Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes |
Medium EPSS 0.36% |
>= 7.2.0, < 7.4.3.13-ga13 | 7.4.3.13-ga13 |
| GHSA-548x-j6x6-hcv4 Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character |
Medium EPSS 0.97% |
>= 7.2.0, < 7.4.3.19-ga19 | 7.4.3.19-ga19 |
| GHSA-43h9-p3j4-39hm Liferay Portal defaults to a low work factor for the default password hashing algorithm |
High EPSS 0.33% |
< 7.4.3.14 | 7.4.3.14 |
| GHSA-869h-qhfx-w939 Liferay Portal has an XXE vulnerability in Java2WsddTask._format |
High EPSS 0.50% |
< 7.4.3.8 | 7.4.3.8 |
| GHSA-mf8h-grfg-j9j3 Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API |
Medium EPSS 0.48% |
>= 7.2.0, < 7.4.3.5-ga5 | 7.4.3.5-ga5 |
| GHSA-pw7p-3648-qqmg Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions |
Medium EPSS 0.41% |
>= 7.2.0, < 7.4.3.5-ga5 | 7.4.3.5-ga5 |
| GHSA-4585-28v2-8h46 Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel |
Medium EPSS 0.44% |
>= 7.2.0, < 7.4.3.4-ga4 | 7.4.3.4-ga4 |
| GHSA-qpgh-6v9w-vfv6 Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options |
Medium EPSS 0.33% |
>= 7.2.0, < 7.4.2-ga3 | 7.4.2-ga3 |
| GHSA-f3rf-cr7f-cwc4 Liferay Portal and Liferay DXP Vulnerable to Open Redirect in Countries Management's Edit Region Page |
Medium EPSS 0.39% |
>= 7.4.3.45-ga45, < 7.4.3.102-ga102 | 7.4.3.102-ga102 |
| GHSA-mc8m-4r3w-q2hw Privilege escalation in Liferay Portal |
Medium EPSS 0.48% |
< 7.4.3.16 | 7.4.3.16 |
| GHSA-qwj8-qgpr-8crm Liferay Portal vulnerable to user impersonation |
High EPSS 0.55% |
>= 7.2.0, < 7.4.2 | 7.4.2 |
| GHSA-mqf8-4cqm-p83x Liferay Portal allows attackers to discover the existence of sites |
Medium EPSS 0.59% |
>= 7.2.0, < 7.4.2 | 7.4.2 |
| GHSA-w275-m8cr-hf2v Liferay Portal denial-of-service vulnerability |
Medium EPSS 0.57% |
>= 7.2.0, < 7.4.3.27 | 7.4.3.27 |
| GHSA-2mx7-xvfg-fg53 Liferay Portal's account lockout does not invalidate existing user sessions |
Medium EPSS 0.31% |
>= 7.2.0, < 7.3.1 | 7.3.1 |
| GHSA-9vgq-w5pv-v77q Liferay Portal stored cross-site scripting (XSS) vulnerability |
Medium EPSS 0.56% |
< 7.4.3.12 | 7.4.3.12 |
| GHSA-87m3-6qj3-p3xh Liferay Portal denial of service (memory consumption) |
Medium EPSS 0.69% |
>= 7.2.0, < 7.3.7 | 7.3.7 |
| GHSA-v32m-pf9q-p3xg Liferay Portal XSS with `p_l_back_url_title` on edit content page |
Medium EPSS 0.65% |
>= 7.4.3.94, < 7.4.3.96 | 7.4.3.96 |
| GHSA-p2fc-xxr8-fw3p Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module |
High EPSS 0.40% |
>= 7.4.3.70-ga70, < 7.4.3.77-ga77 | 7.4.3.77-ga77 |
| GHSA-qxf6-mp24-52cv Liferay Portal and Liferay DXP Vulnerable to XSS via the Layout Module |
Medium EPSS 0.45% |
>= 7.4.3.70-ga70, < 7.4.3.74-ga74 | 7.4.3.74-ga74 |
| GHSA-22w7-m5f8-87vh Liferay Portal and Liferay DXP Vulnerable to Open Redirect via the Layout Module |
Medium EPSS 0.47% |
>= 7.4.3.70-ga70, < 7.4.3.77-ga77 | 7.4.3.77-ga77 |
| GHSA-chrc-q6v3-jfv8 Liferay Portal has Inefficient Regular Expression |
High EPSS 0.92% |
>= 7.4.3.48, < 7.4.3.77 | 7.4.3.77 |
| GHSA-g9mr-9xfc-4gf7 Insecure Default Initialization In Liferay Portal |
High EPSS 0.82% |
>= 7.0.0, < 7.3.1 | 7.3.1 |
| GHSA-w6f8-mxf5-4vf8 Missing authorization in Liferay portal |
High EPSS 0.74% |
>= 7.4.3.67, < 7.4.3.68 | 7.4.3.68 |
| GHSA-769c-p92r-xgxj Liferay portal has unauthorized access to object definition via search |
Medium EPSS 0.61% |
>= 7.4.3.4, < 7.4.3.61 | 7.4.3.61 |
| GHSA-2868-ff44-43qv Liferay portal unauthorized access to objects via OAuth 2 scope |
Medium EPSS 0.61% |
>= 7.4.3.4, < 7.4.3.49 | 7.4.3.49 |
| GHSA-g7vw-43xg-8m4h SQL injection in Liferay Portal |
High EPSS 0.55% |
>= 7.3.1, < 7.4.3.18 | 7.4.3.18 |
| GHSA-pfwc-4frf-4gf8 Cross-site scripting in Liferay Portal |
Medium EPSS 0.53% |
>= 7.3.4, < 7.4.3.69 | 7.4.3.69 |
| GHSA-p9xg-9378-cqp7 Cross-site scripting in Liferay Portal |
Medium EPSS 0.45% |
>= 7.4.3.21, < 7.4.3.63 | 7.4.3.63 |
| GHSA-wv99-wmpf-jrqr Cross-site scripting in Liferay Portal |
Medium EPSS 0.53% |
>= 7.4.3.50, < 7.4.3.51 | 7.4.3.51 |
| GHSA-mvfv-w3fq-xp67 Cross-site scripting in Liferay Portal |
Medium EPSS 0.46% |
>= 7.4.3.41, < 7.4.3.53 | 7.4.3.53 |
| GHSA-x82q-mr23-27jc Cross-site scripting in Liferay Portal |
Medium EPSS 0.53% |
>= 7.4.0, < 7.4.3.31 | 7.4.3.31 |
| GHSA-53mw-69qx-q4fc Cross-site scripting in Liferay Portal |
Medium EPSS 0.52% |
>= 7.1.0, < 7.4.3.13 | 7.4.3.13 |
| GHSA-wvhw-5m89-64gv Cross-site scripting in Liferay Portal |
Medium EPSS 0.52% |
>= 7.3.0, < 7.4.1 | 7.4.1 |
| GHSA-v6m2-j92j-2h78 Cross-site scripting in Liferay Portal |
Medium EPSS 0.45% |
>= 7.1.0, < 7.3.1 | 7.3.1 |
| GHSA-f43m-hhj4-q3jg Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL |
Medium EPSS 0.52% |
>= 7.0.0, < 7.4.3.5-ga5 | 7.4.3.5-ga5 |
| GHSA-cx84-43xc-3gm2 Improper Certificate Validation in Liferay Portal |
Medium EPSS 0.27% |
>= 7.1.0, < 7.4.3.4 | 7.4.3.4 |
| GHSA-mxvq-cv4x-p3jw Incorrect Default Permissions in Liferay Portal |
Medium EPSS 0.66% |
>= 7.1.0, < 7.4.3.5 | 7.4.3.5 |
| GHSA-g6x4-57hp-j4xm Authorization Bypass in Liferay Portal |
Medium EPSS 0.66% |
>= 7.3.2, < 7.4.3.5 | 7.4.3.5 |
| GHSA-wgqm-qp44-cg6x Incorrect Default Permissions in Liferay Portal |
Medium EPSS 0.74% |
>= 7.4.1, < 7.4.3.5 | 7.4.3.5 |
| GHSA-5x9h-p2gx-35mg Incorrect Default Permissions in Liferay Portal |
Medium EPSS 0.74% |
>= 7.4.3.5, < 7.4.3.48 | 7.4.3.48 |
| GHSA-642h-mx8q-47p2 Missing permissions check in Liferay Portal |
Medium EPSS 0.69% |
>= 7.3.5, < 7.4.3.48 | 7.4.3.48 |
| GHSA-g8hp-rc67-jf96 Path Traversal in Liferay Portal |
High EPSS 0.78% |
>= 7.4.3.5, < 7.4.3.48 | 7.4.3.48 |
| GHSA-vjj4-qwcm-552h Inefficient Regular Expression Complexity in Liferay Portal |
High EPSS 1.35% |
>= 7.3.2, < 7.4.3.5 | 7.4.3.5 |
| GHSA-hffx-r282-w2g9 Path Traversal in Liferay Portal |
High EPSS 0.78% |
>= 7.3.3, < 7.4.3.19 | 7.4.3.19 |
| GHSA-hw56-7xj4-7gx6 Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module |
Critical EPSS 0.78% |
>= 7.3.7, < 7.4.0-ga1 | 7.4.0-ga1 |
| GHSA-9427-7f65-88c8 Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled |
Medium EPSS 0.54% |
>= 7.0.0-a1, < 7.4.2-ga3 | 7.4.2-ga3 |
| GHSA-w397-9p2j-6x23 Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented |
Medium EPSS 0.60% |
>= 7.3.1-ga2, < 7.4.3.4-ga4 | 7.4.3.4-ga4 |
| GHSA-83qx-288m-72w4 Liferay Portal Missing Authorization vulnerability |
Medium EPSS 0.56% |
>= 7.3.3, < 7.4.3.35 | 7.4.3.35 |
| GHSA-6xxc-4jc4-7jv3 Exposure of Resource to Wrong Sphere in Liferay Portal |
Medium EPSS 1.12% |
>= 7.2.0, < 7.3.3 | 7.3.3 |
| GHSA-5gh9-g62h-f35m Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers |
High EPSS 1.31% |
>= 7.0.3, < 7.3.5 | 7.3.5 |
| GHSA-4frg-rpx6-96qh Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs |
High EPSS 0.42% |
>= 7.1.0, < 7.3.3 | 7.3.3 |
| GHSA-7pxh-q6jw-6xj8 Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site Scripting |
Medium EPSS 0.67% |
>= 7.2.1, < 7.3.5 | 7.3.5 |
| GHSA-fvg6-9r88-7w85 Liferay Portal Journal Module and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) |
Medium EPSS 0.68% |
>= 7.3.0, < 7.3.4 | 7.3.4 |
| GHSA-9h7f-5hc8-cj5f Liferay Portal cross-site scripting (XSS) vulnerability in the Frontend Taglib module |
Medium EPSS 0.87% |
>= 7.4.0, < 7.4.1 | 7.4.1 |
| GHSA-474f-cmx5-gm69 Liferay Portal and Liferay DXP Don't Check Permissions of Pages |
Medium EPSS 0.88% |
>= 7.1.0, < 7.3.2 | 7.3.2 |
| GHSA-jfch-m2x3-2v66 Liferay Portal and Liferay DXP insecure default configuration |
High EPSS 1.43% |
< 7.3.3 | 7.3.3 |
| GHSA-6c88-gvxw-f5hg Liferay Portal and Liferay DXP Stores User Passwords in Cleartext |
Medium EPSS 0.57% |
>= 7.3.0, <= 7.3.2 | No fix yet |
| GHSA-vpvm-3wfw-5f5c Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page |
Medium EPSS 0.68% |
>= 7.0.0, <= 7.3.4 | No fix yet |
| GHSA-g37f-j8hh-736f Liferay Portal and Liferay DXP Fails to Properly Check User Permissions |
Medium EPSS 0.86% |
>= 7.0.0, <= 7.3.2 | No fix yet |
| GHSA-mj8w-h522-jwm8 Liferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs |
Medium EPSS 0.98% |
>= 7.0.0, <= 7.3.1 | No fix yet |
| GHSA-g7xc-m762-wg8f Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions |
Medium EPSS 0.85% |
<= 7.3.2 | No fix yet |
| GHSA-9995-qvcg-x7g6 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) |
Medium EPSS 0.84% |
>= 7.1.0, <= 7.3.2 | No fix yet |
| GHSA-f9wj-c5pc-g9rh Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections |
High EPSS 1.16% |
>= 7.3.5, < 7.3.6 | 7.3.6 |
| GHSA-qcv4-gv43-498v Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin Page |
Medium EPSS 0.80% |
>= 7.3.2, <= 7.3.5 | No fix yet |
| GHSA-xx2h-2hf5-v7vv Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password |
Medium EPSS 0.74% |
>= 7.0.0, < 7.3.6 | 7.3.6 |
| GHSA-wcr5-3q96-c2gr Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page |
Medium EPSS 0.75% |
>= 7.0.0, < 7.3.6 | 7.3.6 |
| GHSA-4fx8-82f3-xcpc Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page |
Medium EPSS 0.87% |
>= 7.3.4, < 7.3.6 | 7.3.6 |
| GHSA-9g57-m5vf-qp73 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module Parameter |
Medium EPSS 0.88% |
No fix yet | |
| GHSA-jvvx-8g42-9559 Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App |
Medium EPSS 0.75% |
>= 7.2.1, < 7.3.6 | 7.3.6 |
| GHSA-pr7v-qv65-rp9m Liferay Portal and Liferay DXP Fails to Check Permissions |
Medium EPSS 0.77% |
>= 7.3.0, <= 7.3.5 | No fix yet |
| GHSA-239w-4f3w-cfcv Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page |
Medium EPSS 0.75% |
>= 7.3.4, < 7.3.5 | 7.3.5 |
| GHSA-87x7-pwrx-jch7 Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages |
Medium EPSS 1.08% |
< 7.3.5 | 7.3.5 |
| GHSA-9mxg-p873-6793 Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use |
High EPSS 1.06% |
>= 7.3.4, < 7.3.6 | 7.3.6 |
| GHSA-pvpg-9553-f979 Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via User Name Parameter |
Medium EPSS 0.95% |
<= 7.1.3 | No fix yet |
| GHSA-pvpg-9553-f979 Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via User Name Parameter |
Medium EPSS 0.95% |
>= 7.2, <= 7.2.1 | No fix yet |
| GHSA-vrwx-q9pj-x488 Liferay Portal and Liferay DXP Bypass via Double Encoded URL |
Medium EPSS 1.22% |
< 7.3.1 | 7.3.1 |
| GHSA-mg3r-9jh8-33r9 Liferay Portal and Liferay DXP have Insecure Deserialization Vulnerability |
High EPSS 1.79% |
< 7.3.0 | 7.3.0 |
| GHSA-773f-f929-qgjj Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection |
High EPSS 1.51% |
< 7.3.0 | 7.3.0 |
| GHSA-8j5r-9687-88w5 Liferay Portal and Liferay DXP Fails to Sanitize API Data |
Medium EPSS 1.59% |
>= 7.0.0, < 7.3.2 | 7.3.2 |
| GHSA-v377-8f8f-532h Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution |
High EPSS 3.69% |
< 7.3.2 | 7.3.2 |
| GHSA-f99h-h678-fgg4 Liferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortlet |
Medium EPSS 4.49% |
>= 7.1.0, < 7.3.0 | 7.3.0 |
| GHSA-372h-p48h-xw8q Liferay Portal Allows RCE via Deserialization of a JSON Payload |
Critical EPSS 44.74% |
< 7.1.1 | 7.1.1 |
| GHSA-hwp2-gvm5-452f Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API |
Medium EPSS 2.30% |
< 7.1.0 | 7.1.0 |
| GHSA-75x7-w445-5gwr Liferay Portal Vulnerable to XSS via a Knowledge Base Article Title |
Medium EPSS 0.75% |
< 7.0.3-ga4 | 7.0.3-ga4 |
| GHSA-cm99-x97g-9qx8 Liferay Portal XSS Vulnerability |
Medium EPSS 0.74% |
< 7.0.3-GA4 | 7.0.3-GA4 |
| GHSA-8gqf-26xw-x3gx Liferay Portal XSS Vulnerability |
Medium EPSS 0.74% |
< 7.0.3-GA4 | 7.0.3-GA4 |
| GHSA-cvrj-cw2f-25qw Liferay Portal Vulnerable to XSS via an Invalid portletId |
Medium EPSS 0.61% |
< 7.0.3-ga4 | 7.0.3-ga4 |
| GHSA-6q67-5wvc-rmw9 Liferay Portal Vulnerable to XSS via Mishandled Title or Summary in the Web Content Display |
Medium EPSS 0.74% |
< 7.0.3-ga4 | 7.0.3-ga4 |
| GHSA-jmjf-cmq5-7w25 Liferay Portal Vulnerable to XSS via a Crafted Redirect Field |
Medium EPSS 0.74% |
< 7.0.3-ga4 | 7.0.3-ga4 |
| GHSA-2ggw-8gmc-r2gq Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page |
Medium EPSS 1.01% |
< 7.1.0-a1 | 7.1.0-a1 |
| GHSA-822f-jfpg-hg7h Liferay Portal and Liferay DXP fails to check permissions to view sites/groups |
Medium EPSS 0.75% |
>= 7.4.0, < 7.4.2-ga3 | 7.4.2-ga3 |
| GHSA-822f-jfpg-hg7h Liferay Portal and Liferay DXP fails to check permissions to view sites/groups |
Medium EPSS 0.75% |
No fix yet | |
| GHSA-r39x-3qq4-gxmr Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page |
Medium EPSS 0.58% |
>= 7.3.2, < 7.3.7-ga8 | 7.3.7-ga8 |
| GHSA-mg53-xr8m-86hw Open Redirect in Liferay Portal |
High EPSS 1.76% |
< 7.3.3 | 7.3.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor