Known Vulnerabilities

Liferay Portal 7.4.3.92 This issue was reported by Michael Oelke Severity 1 Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal and Liferay DXP allow...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4
Severity 1 Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML into a parent wiki...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0
Severity 2 Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Severity 2 The organization selector in Liferay Portal and Liferay DXP does not check user permission, which allows remote authenticated users to obtain a list of all organizations. Liferay DXP 7.4...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Liferay DXP 7.4 update 70 through 76 Liferay Portal 7.4.3.70 - 7.4.3.76 Liferay DXP 7.4 update 77 Liferay DXP 7.4 update 77 Liferay Portal 7.4.3.77 Liferay Portal 7.4.3.77 This issue was reported...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Liferay Portal 7.4.3.77 This issue was reported by NDIx Severity 2 Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal and Liferay DXP allows remote attackers to...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Severity 2 Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Severity 1 Pattern Redirects in Liferay Portal and Liferay DXP allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Liferay DXP 7.4 update 67 Liferay Portal 7.4.3.67 Liferay DXP 7.4 update 68 Liferay DXP 7.4 update 68 Liferay Portal 7.4.3.68 Liferay Portal 7.4.3.68 Severity 2 The Dynamic Data Mapping module in...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Liferay Portal 7.4.3.61 Severity 2 The Object module in Liferay Portal and Liferay DXP does not segment object definition by virtual instance in search which allows remote authenticated users in...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Severity 2 The Object module in Liferay Portal and Liferay DXP does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Severity 2 Liferay DXP 7.3 update 6 Liferay DXP 7.4 update 18 Liferay Portal 7.4.3.18 Liferay DXP 7.3 before update 6 Liferay DXP 7.4 before update 18 Liferay Portal 7.3.1 - 7.3.7 Liferay Portal...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4
Liferay DXP 7.3 update 24 Liferay DXP 7.3 update 24 Liferay DXP 7.4 update 69 Liferay Portal 7.4.3.69 Liferay Portal 7.4.3.69 Liferay DXP 7.4 update 69 Severity 2 Cross-site scripting (XSS)...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4
Severity 2 Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Liferay DXP 7.4 update 50 Liferay Portal 7.4.3.50 Liferay DXP 7.4 update 51 Liferay DXP 7.4 update 51 Liferay Portal 7.4.3.51 Liferay Portal 7.4.3.51 Severity 2 Cross-site scripting (XSS)...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Liferay Portal 7.4.3.53 Severity 2 Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal and Liferay DXP...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Severity 2 Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the Remote App's...

Releases: Liferay Portal 7.4 Liferay DXP 7.4
Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4

Showing 161 to 178 of 178 entries.

1
- 2
- 3
- 4
- 5
- 6
7
8
9

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Learn More >

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Learn More >

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!

Learn More >

Community

Company

Feedback

Known Vulnerabilities

Liferay DXP 7.1

Liferay DXP 7.2

Liferay DXP 7.3

Liferay DXP 7.4

Liferay DXP 2023.Q3

Liferay DXP 2023.Q4

Liferay DXP 2024.Q1

Liferay DXP 2024.Q2

Liferay DXP 2024.Q3

Liferay DXP 2024.Q4

Liferay DXP 2025.Q1

Liferay DXP 2025.Q2

Liferay DXP 2025.Q3

Liferay Portal 7.4.3

Found a Bug?

Found a Security Vulnerability?

Hall of Fame!