- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 125 · 24 critical, 10 high, 45 medium
- Registry
- Maven Central
Advisories 125
- CVE-2025-43785Medium 4.6
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9…
Affected: from 2024.Q2.0, fixed in 2024.Q3.0; from 2024.Q1.1, fixed in 2024.Q1.13; from 7.4.13.u14, through 7.4.13.u92.
- CVE-2025-43776Medium 4.6
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9…
Affected: from 7.4, through 7.4.13.u92; from 2024.Q1.1, fixed in 2024.Q1.20; from 2024.Q2.0, through 2024.Q2.13; from 2024.Q3.0, through 2024.Q3.13; from 2024.Q4.0, through 2024.Q4.7; from 2025.Q1.0, fixed in 2025.Q1.17; from 2025.Q2.0, fixed in 2025.Q2.10.
- CVE-2025-43734Medium 5.1
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through…
Affected: from 2024.q4.0, through 2024.q4.7; from 2024.q3.0, through 2024.q3.13; from 2024.q2.0, through 2024.q2.13; from 2024.q1.0, fixed in 2024.q1.17; from 2025.q1.0, fixed in 2025.q1.11; through 7.4.13.u92.
- CVE-2025-43735Medium 6.9
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through…
Affected: from 2024.q4.0, through 2024.q4.7; from 2024.q3.0, through 2024.q3.13; from 2024.q2.0, through 2024.q2.13; from 2024.q1.0, fixed in 2024.q1.13; through 7.4.13.u92.
- CVE-2025-43736Medium 6.9
A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through…
Affected: from 2025.Q1.0, fixed in 2025.Q1.9; from 2024.Q4.0, through 2024.Q4.7; from 2024.Q3.0, through 2024.Q3.13; from 2024.Q2.0, through 2024.Q2.13; from 2024.Q1.0, fixed in 2024.Q1.17; through 7.4.13.u92.
- CVE-2025-4655Medium 5.1
SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5…
Affected: from 2025.Q1.0, fixed in 2025.Q1.6; from 2024.Q4.0, through 2024.Q4.7; from 2024.Q3.1, through 2024.Q3.13; from 2024.Q2.0, through 2024.Q2.13; from 2024.Q1.0, fixed in 2024.Q1.16; through 7.4.13.u92.
- CVE-2025-4581Medium 5.3
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through…
Affected: from 2025.Q1.0, fixed in 2025.Q1.5; from 2024.Q4.0, through 2024.Q4.7; from 2024.Q3.1, through 2024.Q3.13; from 2024.Q2.0, through 2024.Q2.13; from 2024.Q1.0, fixed in 2024.Q1.16; through 7.4.13.u92.
- CVE-2025-3760Medium 4.8
A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129…
Affected: from 7.2.10.fp1, through 7.2.10.fp20; from 7.3.10.ep1, through 7.3.10.u36; from 7.4.13.u1, through 7.4.13.u92; from 2023.Q3.1, through 2023.Q3.10; from 2023.Q4.0, through 2023.Q4.10; from 2024.Q1.1, fixed in 2024.Q1.13; from 2024.Q2.0, through 2024.Q2.13; from 2024.Q3.1, fixed in 2024.Q3.10; from 2024.Q4.1, fixed in 2025.Q1.0; from 7.2.10, through 7.2.10.8; from 7.3.10.0, through 7.3.10.3; versions 7.4.13.
- CVE-2025-2565Medium 5.1
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12…
Affected: from 2024.Q3.0, fixed in 2024.Q3.1; from 2024.Q2.0, through 2024.Q2.12; from 2024.Q1.1, fixed in 2024.Q1.13; from 2023.Q4.0, through 2023.Q4.10; from 2023.Q3.1, through 2023.Q3.10.
- CVE-2025-2536Medium 5.1
Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through…
Affected: from 2024.Q2.0, through 2024.Q2.11; from 2024.Q1.1, fixed in 2024.Q1.13; from 2023.Q4.0, fixed in 2024.Q4.0; from 2023.Q3.1, fixed in 2024.Q4.0; from 2024.Q3.0, fixed in 2024.Q3.1.
- CVE-2023-37940Medium 4.8
Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP…
Affected: from 7.0, fixed in 7.3.10.u30; from 7.4, fixed in 7.4.13.u88.
- CVE-2024-11993Medium 4.6
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38…
Affected: from 7.1, fixed in 7.4.13.u39.
- CVE-2024-38002Critical 9.0
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through…
Affected: from 2023.Q4.0, fixed in 2023.Q4.6; from 2023.Q3.1, fixed in 2023.Q3.9; from 7.3-ga, fixed in 7.3.10.u36; from 7.4-ga, fixed in 7.4.13.u92.
- CVE-2024-26273High 8.8
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP…
Affected: from 2023.Q4.0, fixed in 2023.Q4.3; from 2023.Q3.1, fixed in 2023.Q3.6; from 7.4.GA, fixed in 7.4u93; from 7.3u29, fixed in 7.3u36.
- CVE-2024-26272High 8.8
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP…
Affected: from 2023.Q4.0, fixed in 2023.Q4.3; from 2023.Q3.1, fixed in 2023.Q3.6; from 7.3.GA, fixed in 7.3u36; from 7.4.GA, fixed in 7.4u93.
Show all 125 advisoriesShow fewer advisories
- CVE-2024-8980Critical 9.6
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3…
Affected: from 2023.Q3.1, fixed in 2023.Q3.5; from 7.0.0-GA, through 7.0.10.fp102; from 7.1.0-GA, through 7.1.10.fp28; from 7.2.0.GA, through 7.2.10.fp20; from 7.3.0-GA, fixed in 7.3.10.u36; from 7.4.0-GA, through 7.4.13.u92.
- CVE-2024-26271High 8.8
Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP…
Affected: from 2023.Q4.0, fixed in 2023.Q4.3; from 2023.Q3.1, fixed in 2023.Q3.6; from 7.3u32, fixed in 7.3u37; from 7.4u75, fixed in 7.4u93.
- CVE-2023-47795Critical 9.0
Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay…
Affected: from 2023.Q3, fixed in 2023.Q3.6; from 7.4.13.u18, through 7.4.13.u92.
- CVE-2024-25151Medium 5.4
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2…
Affected: from 7.3.0, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp15.
- CVE-2023-40191Critical 9.0
Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and…
Affected: from 2023.Q3, fixed in 2023.Q3.6; from 7.4.13.u44, through 7.4.13.u92.
- CVE-2023-42498Critical 9.6
Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and…
Affected: from 2023.Q3, fixed in 2023.Q3.5; from 7.4.13.u4, through 7.4.13.u92.
- CVE-2024-26269Critical 9.6
Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP…
Affected: from 7.4.13.u1, fixed in 7.4.13.u38; from 7.3.10.ep3, fixed in 7.3.10.u11; from 7.2.0, fixed in 7.2.10.fp20.
- CVE-2024-26266Critical 9.0
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and…
Affected: from 7.4.13.u1, fixed in 7.4.13.u10; from 7.3.10.ep3, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp17.
- CVE-2023-42496Critical 9.6
Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and…
Affected: from 7.4.10.ep1, through 7.4.13.u92; from 7.3.10.ep3, fixed in 7.3.10.u34; from 2023.Q3, fixed in 2023.Q3.6.
- CVE-2024-25603Critical 9.0
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and…
Affected: from 7.4.13.u1, through 7.4.13.u102; from 7.3.10.ep3, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp17.
- CVE-2024-25152Critical 9.0
Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported…
Affected: from 7.3.0, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp17.
- CVE-2024-25601Critical 9.0
Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and…
Affected: from 7.3.0, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp17.
- CVE-2024-25602Critical 9.0
Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older…
Affected: from 7.3.0, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp17.
- CVE-2024-25147Critical 9.6
Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions…
Affected: from 7.3.0, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp15.
- CVE-2024-26270Medium 6.5
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through…
Affected: from 2023.Q3, fixed in 2023.Q3.5; from 7.4.0, through 7.4.13.u92.
- CVE-2024-26268Medium 5.3
User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update…
Affected: fixed in 7.2.10.fp20; from 7.3.0, fixed in 7.3.10.u8; from 7.4.0, fixed in 7.4.13.u27.
- CVE-2024-26267Medium 5.3
In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2…
Affected: fixed in 7.2.10.fp19; from 7.3.0, fixed in 7.3.10.u5; from 7.4.0, fixed in 7.4.13.u26.
- CVE-2024-25610Critical 9.0
In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2…
Affected: from 7.4.0, fixed in 7.4.13.u9; from 7.3.0, fixed in 7.3.10.u4; fixed in 7.2.10.fp19.
- CVE-2024-25609Medium 6.1
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3…
Affected: from 7.2.10.fp15, through 7.2.10.fp18; from 7.4.0, fixed in 7.4.13.u9.
- CVE-2024-25608Medium 6.1
HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19…
Affected: fixed in 7.2.10.fp19; from 7.3.0, fixed in 7.3.10.u4; from 7.4.0, fixed in 7.4.13.u19.
- CVE-2024-25607High 8.1
The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and…
Affected: from 7.3.0, fixed in 7.3.10.u4; fixed in 7.2.10.fp17; from 7.4.0, fixed in 7.4.13.u16.
- CVE-2024-25606High 8.0
XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before…
Affected: from 7.3.0, fixed in 7.3.10.u12; from 7.4.0, fixed in 7.4.13.u4; fixed in 7.2.10.fp20.
- CVE-2024-25605Medium 5.3
The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service…
Affected: fixed in 7.2.10.fp17.
- CVE-2024-25604Medium 6.5
Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix…
Affected: versions 7.4.13; fixed in 7.2.10.fp17.
- CVE-2024-25150Medium 4.3
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and…
Affected: fixed in 7.2.10.fp19; from 7.3.0, fixed in 7.3.10.u4.
- CVE-2024-25149Medium 5.4
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and…
Affected: fixed in 7.2.10.fp15.
- CVE-2023-5190Medium 6.1
Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP…
Affected: from 2023.Q3, fixed in 2023.Q3.6; from 7.4.13.u45, through 7.4.13.u92.
- CVE-2021-29050High 8.8
Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before…
Affected: from 7.2.0, fixed in 7.2.10.fp11.
- CVE-2021-29038Medium 6.3
Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and…
Affected: fixed in 7.2.10.fp17; from 7.3.0, fixed in 7.3.10.fp1.
- CVE-2024-25148Medium 5.4
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15…
Affected: from 7.2.0, fixed in 7.2.10.fp15; from 7.3.0, fixed in 7.3.10.u4.
- CVE-2024-25146Medium 5.3
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and…
Affected: from 7.3.0, fixed in 7.3.10.u4; from 7.2.0, fixed in 7.2.10.fp18.
- CVE-2024-25144Medium 4.1
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3…
Affected: from 7.2.0, fixed in 7.2.10.fp19; from 7.3.0, fixed in 7.3.10.u6; from 7.4.0, fixed in 7.4.13.u27.
- CVE-2023-47798Medium 5.4
Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older…
Affected: from 7.2.0, fixed in 7.2.10.fp5.
- CVE-2024-25145Critical 9.6
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11…
Affected: from 7.4.0, fixed in 7.4.3.13u8; from 7.3.0, fixed in 7.3.10.u4; fixed in 7.2.10.fp17.
- CVE-2023-42627Critical 9.6
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay…
Affected: from 7.3.0, through 7.3.10.u33; from 7.4.0, through 7.4.13.u92.
- CVE-2023-42628Critical 9.0
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack…
Affected: from 7.0.10.fp83, through 7.0.10.fp102; from 7.1.0, through 7.1.10.fp28; from 7.2.0, through 7.2.10.fp20; from 7.3.0, fixed in 7.3.10.u34; from 7.4.0, fixed in 7.4.13.u88.
- CVE-2023-44311Critical 9.6
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class…
Affected: from 7.4.13.u41, fixed in 7.4.13.u90.
- CVE-2023-44310Critical 9.0
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1…
Affected: from 7.3.10.fp1, through 7.3.10.fp23; from 7.4.0, fixed in 7.4.13.u79.
- CVE-2023-44309Critical 9.0
Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and…
Affected: from 7.4.0, fixed in 7.4.13.u54.
- CVE-2023-42629Critical 9.0
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP…
Affected: from 7.4.0, fixed in 7.4.13.u88.
- CVE-2023-42497Critical 9.6
Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and…
Affected: from 7.4.0, fixed in 7.4.13.u86.
- CVE-2023-3426Medium 4.3
The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user…
Affected: from 7.4.143.u81, through 7.4.143.u85.
- CVE-2023-35030High 8.8
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and…
Affected: from 7.4.13.u70, through 7.4.13.u76.
- CVE-2023-35029Medium 6.1
Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4…
Affected: from 7.4.13.u70, through 7.4.13.u76.
- CVE-2023-3193Medium 6.1
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay…
Affected: from 7.4.13.u70, through 7.4.13.u73.
- CVE-2022-42132Medium 5.9
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix…
Affected: from 7.0.0, through 7.0.10.fp102; from 7.1.0, fixed in 7.1.10.fp27; from 7.2.0, fixed in 7.2.10.fp17; from 7.3.0, fixed in 7.3.10.u4; versions 7.4.0.ga1.
- CVE-2022-42122Critical 9.8
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows…
Affected: from 7.3.10.fp2, fixed in 7.3.10.u4.
- CVE-2022-42121High 8.8
A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2…
Affected: from 7.1.0, fixed in 7.1.10.fp27; from 7.2.0, fixed in 7.2.10.fp17.
- CVE-2022-42120Critical 9.8
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and…
Affected: from 7.3.0, fixed in 7.3.10.u4; from 7.4.0, fixed in 7.4.13.u17.
- CVE-2022-42119Medium 5.4
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module.
Affected: from 7.3.0, fixed in 7.3.10.u8.
- CVE-2022-42118Medium 6.1
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before…
Affected: from 7.1.0, fixed in 7.1.10.fp27; from 7.2.0, fixed in 7.2.10.fp15.
- CVE-2022-42111Unrated
A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay…
Affected: from 7.2.0, fixed in 7.2.10.fp19; from 7.3.0, fixed in 7.3.10.u4.
- CVE-2022-42110Medium 6.1
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before…
Affected: from 7.1.0, fixed in 7.1.10.fp27; from 7.2.0, fixed in 7.2.10.fp17.
- CVE-2022-42117Medium 6.1
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.3.2 through 7.4.3.16, and Liferay DXP 7.3…
Affected: from 7.3.0, fixed in 7.3.10.u6; from 7.4.0, fixed in 7.4.13.u17.
- CVE-2022-42116Medium 6.1
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through…
Affected: from 7.3.0, fixed in 7.3.10.u6; from 7.4.0, fixed in 7.4.13.u15.
- CVE-2022-42114Medium 5.4
A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36, and…
Affected: from 7.4.0, fixed in 7.4.13.u37.
- CVE-2022-42113Medium 6.1
A Cross-site scripting (XSS) vulnerability in Document Library module in Liferay Portal 7.4.3.30 through 7.4.3.36, and Liferay DXP 7.4…
Affected: from 7.4.13.u30, fixed in 7.4.13.u37.
- CVE-2022-42112Medium 5.4
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget in Liferay Portal 7.2.0 through 7.4.3.24, and Liferay…
Affected: from 7.2.0, fixed in 7.2.10.fp19; from 7.3.0, fixed in 7.3.10.u5; from 7.4.0, fixed in 7.4.13.u25.
- CVE-2022-38512Medium 6.5
The Translation module in Liferay Portal v7.4.3.12 through v7.4.3.36, and Liferay DXP 7.4 update 8 through 36 does not check permissions…
Affected: from 7.4.13.u8, fixed in 7.4.13.u37.
- CVE-2022-28980Medium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute…
Affected: fixed in 7.4.3.5-ga5.
- CVE-2022-28977Medium 6.1
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25…
Affected: from 7.0.10.fp91, fixed in 7.0.10.fp101; from 7.1.10.fp17, fixed in 7.1.10.fp25; from 7.2.10.fp5, fixed in 7.2.10.fp14.
- CVE-2022-28978Medium 5.4
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through…
Affected: from 7.0.0, fixed in 7.0.10.fp102; from 7.1.0, fixed in 7.1.10.fp26; from 7.2.0, fixed in 7.2.10.fp15.
- CVE-2022-28979Medium 6.1
Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was…
Affected: from 7.1.0; from 7.2.0.
- CVE-2022-26596Unrated
Cross-site scripting (XSS) vulnerability in Journal module's web content display configuration page in Liferay Portal 7.1.0 through 7.3.3…
Affected: from 7.0.0, fixed in 7.0.10.fp94; from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp8.
- CVE-2022-26597Unrated
Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay…
Affected: from 7.3.0, fixed in 7.3.10.fp3.
- CVE-2022-26595Unrated
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when…
Affected: from 7.2.0, fixed in 7.2.10.fp13; from 7.3.0, fixed in 7.3.10.fp2.
- CVE-2022-26593Unrated
Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and…
Affected: from 7.3.0, fixed in 7.3.10.fp3.
- CVE-2022-26594Unrated
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow…
Affected: from 7.3.0, fixed in 7.3.10.fp3.
- CVE-2022-25146Unrated
The Remote App module in Liferay Portal Liferay Portal v7.4.3.4 through v7.4.3.8 and Liferay DXP 7.4 before update 5 does not check if the…
Affected: fixed in 7.4.13.u5.
- CVE-2021-38269Unrated
Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1…
Affected: from 7.1.0, fixed in 7.1.10.fp23; from 7.2.0, fixed in 7.2.10.fp13; from 7.3.0, fixed in 7.3.10.fp2.
- CVE-2021-38267Unrated
Cross-site scripting (XSS) vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP…
Affected: from 7.3.0, fixed in 7.3.10.fp2.
- CVE-2021-38263Unrated
Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0…
Affected: through 7.0.
- CVE-2021-38265Unrated
Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject…
Affected: through 7.3.
- CVE-2021-38266Unrated
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2…
Affected: fixed in 7.3.0-ga1.
- CVE-2021-38268Unrated
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21…
Affected: from 7.0.0, fixed in 7.0.10.fp101; from 7.1.0, fixed in 7.1.10.fp21; from 7.2.0, fixed in 7.2.10.fp10; from 7.3.0, fixed in 7.3.10.fp2.
- CVE-2021-33337Unrated
Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and…
Affected: from 7.1.0, fixed in 7.1.10.fp20; from 7.2.0, fixed in 7.2.10.fp9.
- CVE-2021-33338Unrated
The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the…
Affected: from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp6.
- CVE-2021-33336Unrated
Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP…
Affected: from 7.1.0, fixed in 7.1.10.fp18; from 7.2.10.fp5, fixed in 7.2.10.fp7.
- CVE-2021-33339Unrated
Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack…
Affected: from 7.2.0, fixed in 7.2.10.fp9.
- CVE-2021-33335Unrated
Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack…
Affected: from 7.1.0, fixed in 7.1.10.fp20; from 7.2.0, fixed in 7.2.10.fp9.
- CVE-2021-33332Unrated
Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1…
Affected: from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp7.
- CVE-2021-33334Unrated
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and…
Affected: from 7.0.10.fp0, fixed in 7.0.10.fp94; from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp6.
- CVE-2021-33333Unrated
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2…
Affected: fixed in 7.0.10.fp93; from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp6.
- CVE-2021-33331Unrated
Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1…
Affected: from 7.0.10.fp0, fixed in 7.0.10.fp94; from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp8.
- CVE-2021-33327Unrated
The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and…
Affected: from 7.0.10.fp93, fixed in 7.0.10.fp95; from 7.1.10.fp18, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp8.
- CVE-2021-33328Unrated
Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP…
Affected: from 7.0.10.fp0, fixed in 7.0.10.fp96; from 7.1.0, fixed in 7.1.10.fp20; from 7.2.0, fixed in 7.2.10.fp9.
- CVE-2021-33326Unrated
Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix…
Affected: from 7.0.0, fixed in 7.0.10.fp96; from 7.1.0, fixed in 7.1.10.fp20; from 7.2.0, fixed in 7.2.10.fp9.
- CVE-2021-33325Unrated
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2…
Affected: fixed in 7.0.10.fp93; from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp7.
- CVE-2021-33322Unrated
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password…
Affected: from 7.0.0, fixed in 7.0.10.fp96; from 7.1.0, fixed in 7.1.10.fp18; from 7.2.0, fixed in 7.2.10.fp5.
- CVE-2021-33324Unrated
The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not…
Affected: fixed in 7.1.10.fp20; from 7.2.0, fixed in 7.2.10.fp5.
- CVE-2021-33323Unrated
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7…
Affected: from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp7.
- CVE-2021-33320Unrated
The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix…
Affected: from 7.0.0, fixed in 7.0.10.fp96; from 7.1.0, fixed in 7.1.10.fp20; from 7.2.0, fixed in 7.2.10.fp5.
- CVE-2021-29049Unrated
Cross-site scripting (XSS) vulnerability in the Portal Workflow module's edit process page in Liferay DXP 7.0 before fix pack 99, 7.1…
Affected: from 7.0, fixed in 7.0.10.fp99; from 7.1.0, fixed in 7.1.10.fp23; from 7.2.0, fixed in 7.2.10.fp12; from 7.3.0, fixed in 7.3.10.fp1.
- CVE-2021-29052Unrated
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in…
Affected: fixed in 7.3.10.fp1.
- CVE-2021-29048Unrated
Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP…
Affected: fixed in 7.2.10.fp11; from 7.3.0, fixed in 7.3.10.fp1.
- CVE-2021-29051Unrated
Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP…
Affected: fixed in 7.1.10.fp21; from 7.2.0, fixed in 7.2.10.fp10; from 7.3.0, fixed in 7.3.10.fp1.
- CVE-2021-29044Unrated
Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through…
Affected: from 7.0.10.fp0, fixed in 7.0.10.fp97; from 7.1.0, fixed in 7.1.10.fp21; from 7.2.0, fixed in 7.2.10.fp10; from 7.3.0, fixed in 7.3.10.fp1.
- CVE-2021-29043Unrated
The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before…
Affected: fixed in 7.0.10.fp97; from 7.1.0, fixed in 7.1.10.fp21; from 7.2.0, fixed in 7.2.10.fp10; from 7.3.0, fixed in 7.3.10.fp1.
- CVE-2021-29053Unrated
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to…
Affected: fixed in 7.3.10.fp1.
- CVE-2021-29046Unrated
Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3…
Affected: from 7.3.10.fp0, fixed in 7.3.10.fp1.
- CVE-2021-29045Unrated
Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5…
Affected: from 7.3.10.fp0, fixed in 7.3.10.fp1.
- CVE-2021-29047Unrated
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers…
Affected: fixed in 7.3.10.fp1.
- CVE-2021-29041Unrated
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote…
Affected: fixed in 7.3.10.fp1.
- CVE-2021-29040Unrated
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before…
Affected: fixed in 7.0.10.fp97; from 7.1.0, fixed in 7.1.10.fp20; from 7.2.0, fixed in 7.2.10.fp10.
- CVE-2020-15840Unrated
In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property…
Affected: fixed in 7.0.10.fp93; from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp7.
- CVE-2020-15839Unrated
Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a…
Affected: fixed in 7.1.10.fp18; from 7.2.1, fixed in 7.2.10.fp6.
- CVE-2020-15842High 8.1
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows…
Affected: from 7.0.0, fixed in 7.0.10.fp90; from 7.1.0, fixed in 7.1.10.fp17; from 7.2.0, fixed in 7.2.10.fp5.
- CVE-2020-15841High 8.3
Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely…
Affected: from 7.0.0, fixed in 7.0.10.fp89; from 7.1.0, fixed in 7.1.10.fp17; from 7.2.0, fixed in 7.2.10.fp4.
- CVE-2020-13444Unrated
Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not…
Affected: from 7.0.0, fixed in 7.0.10.fp92; from 7.1.0, fixed in 7.1.10.fp19; from 7.2.0, fixed in 7.2.10.fp7.
- CVE-2020-13445Unrated
In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API…
Affected: from 7.0.0, fixed in 7.0.10.fp92; from 7.1.0, fixed in 7.1.10.fp18; from 7.2.0, fixed in 7.2.10.fp6.