Liferay
Page 4 of 4 — Liferay CVEs from a corpus of 340, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15841 | High | 8.3 | 2020-07-20 | Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a… |
CVE-2020-13445 | High | 8.8 | 2020-06-10 | In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict us… |
CVE-2020-13444 | Medium | 6.5 | 2020-06-10 | Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information re… |
CVE-2020-7961 | Critical | 9.8 | 2020-03-20 | Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS). |
CVE-2020-7934 | Medium | 5.4 | 2020-01-28 | In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a p… |
CVE-2019-16891 | Critical | 9.8 | 2019-10-04 | Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. |
CVE-2019-16147 | Medium | 6.1 | 2019-09-09 | Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib. |
CVE-2019-6588 | Medium | 4.7 | 2019-06-03 | In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of… |
CVE-2019-11444 | High | 7.2 | 2019-04-22 | An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed vi… |
CVE-2018-10795 | High | 8.8 | 2018-05-07 | Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically proces… |
CVE-2017-1000425 | Medium | 6.1 | 2018-01-02 | Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary… |
CVE-2017-17868 | Medium | 6.1 | 2017-12-27 | In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag. |
CVE-2017-12649 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display. |
CVE-2017-12648 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL. |
CVE-2017-12647 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title. |
CVE-2017-12646 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address. |
CVE-2017-12645 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId. |
CVE-2016-10404 | Medium | 6.1 | 2017-08-07 | XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted redirect field to modules/apps/foundation/frontend-js/frontend-js-spa-web/src/main/resources/META-… |
CVE-2016-6517 | Critical | 9.8 | 2017-01-23 | Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the minifierBundleDir p… |
CVE-2010-5327 | High | 8.8 | 2017-01-13 | Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template. |
CVE-2016-3670 | Medium | 6.1 | 2016-06-13 | Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbi… |
CVE-2014-8349 | | 2014-11-24 | Cross-site scripting (XSS) vulnerability in Liferay Portal Enterprise Edition (EE) 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary we… | |
CVE-2014-2963 | | 2014-07-10 | Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers… | |
CVE-2011-1571 | | 2011-05-07 | Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows r… | |
CVE-2011-1570 | | 2011-05-07 | Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated… | |
CVE-2011-1504 | | 2011-05-07 | Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbit… | |
CVE-2011-1503 | | 2011-05-07 | The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote aut… | |
CVE-2011-1502 | | 2011-05-07 | Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity… | |
CVE-2009-3742 | | 2010-01-07 | Cross-site scripting (XSS) vulnerability in Liferay Portal before 5.3.0 allows remote attackers to inject arbitrary web script or HTML via the p_p_id parameter. | |
CVE-2009-1294 | | 2009-04-16 | Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attack… | |
CVE-2008-0563 | | 2008-02-05 | Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecifie… | |
CVE-2008-0182 | | 2008-02-05 | Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified ac… | |
CVE-2008-0181 | | 2008-02-05 | Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML… | |
CVE-2008-0180 | | 2008-02-05 | Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary we… | |
CVE-2008-0179 | | 2008-02-05 | Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web scri… | |
CVE-2008-0178 | | 2008-02-05 | Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inje… | |
CVE-2007-6173 | | 2007-11-30 | Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1 allows remote attackers to inject arbitrary web script or HTML vi… | |
CVE-2007-6055 | | 2007-11-20 | Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1 allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2005-4400 | | 2005-12-20 | Cross-site scripting (XSS) vulnerability in downloads/portal_ent in Liferay Portal Enterprise 3.6.1 and earlier allows remote attackers to inject arbitrary web… | |
CVE-2004-2030 | | 2004-05-22 | Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004 allow remote attackers to inject arbitrary web scri… |