Known Vulnerabilities

The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Liferay Portal 7.4.3.36 Liferay Portal 7.4.3.36 Severity 2 Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 allows attackers to create or overwrite existing files...

Releases: Liferay Portal 7.4
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 allows remote attackers to consume an excessive amount of server resources via a crafted payload...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Severity 2 Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18 allows attackers to create or overwrite existing files on the filesystem via the...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Liferay Portal 7.4.0 There is no fix available for Liferay Portal 7.3. Please upgrade to Liferay Portal 7.4. Liferay Portal 7.3.7 Liferay Portal 7.4.0 SQL injection vulnerability in the Friendly...

Releases: Liferay Portal 7.3
Severity 2 SQL injection vulnerability in the Layout module's page template upgrade process in Liferay Portal 7.1.3 through 7.4.3.4 allows remote authenticated attackers to execute arbitrary SQL...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1
SQL injection vulnerability in the Fragment module's PortletPreferences upgrade process in Liferay Portal 7.3.3 through 7.4.3.16 allows attackers to execute arbitrary SQL commands via a...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Liferay Portal 7.3.5 - 7.3.7 Liferay Portal 7.4.0 - 7.4.2 Liferay Portal 7.4.3.4 Liferay Portal 7.4.3.4 There is no fix available for Liferay Portal 7.3. Please upgrade to Liferay Portal 7.4. This...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Severity 2 Cross-site scripting (XSS) vulnerability in the Portal Search module's Tag Facet widget in Liferay Portal 7.1.0 through 7.4.2 allows remote attackers to inject arbitrary web script or...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1
Cross-site scripting (XSS) vulnerability in the Frontend Taglib module's <clay:label> tag in Liferay Portal 7.3.2 through 7.4.3.16 allows remote attackers to inject arbitrary web script or HTML via...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Severity 2 Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Portal 7.3.2 through 7.4.3.14 allows remote attackers to inject arbitrary...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Liferay Portal 7.4.3.37 Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject...

Releases: Liferay Portal 7.4
Severity 2 Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Portal 7.4.0 through 7.4.3.36 allows remote attackers to inject arbitrary web script or...

Releases: Liferay Portal 7.4
Cross-site scripting (XSS) vulnerability in Document Library module's move file interface in Liferay Portal 7.4.3.30 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML...

Releases: Liferay Portal 7.4
Liferay Portal 7.4.3.25 Liferay Portal 7.4.3.25 There is no fix available for Liferay Portal 7.2 and 7.3. Please upgrade to Liferay Portal 7.4. Severity 2 Cross-site scripting (XSS) vulnerability...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2
Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2 allows remote attackers to inject arbitrary web script or HTML by sharing an...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2
Severity 2 Cross-site scripting (XSS) vulnerability in the Announcements module's Announcement and Alerts management page in Liferay Portal 7.1.0 through 7.4.2 allows remote attackers to inject...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1
Liferay Portal 7.3.5 - 7.3.7 Liferay Portal 7.4.0 - 7.4.3.28 Liferay Portal 7.4.3.29 Liferay Portal 7.4.3.29 There is no fix available for Liferay Portal 7.3. Please upgrade to Liferay Portal 7.4....

Releases: Liferay Portal 7.4 Liferay Portal 7.3
This issue was reported by Rafal Lykowski, A1 Digital International Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector input field in Liferay Portal 7.3.0...

Releases: Liferay Portal 7.4 Liferay Portal 7.3
Severity 2 The Layout module in Liferay Portal 7.3.3 through 7.4.3.34 does not check user permission before showing the preview of a "Content Page" type page, which allows remote attackers to view...

Releases: Liferay Portal 7.4 Liferay Portal 7.3

Showing 221 to 240 of 499 entries.

1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
11
12
13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
25

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Learn More >

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Learn More >

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!

Learn More >

Community

Company

Feedback

Known Vulnerabilities

Liferay DXP 7.1

Liferay DXP 7.2

Liferay DXP 7.3

Liferay DXP 7.4

Liferay DXP 2023.Q3

Liferay DXP 2023.Q4

Liferay DXP 2024.Q1

Liferay DXP 2024.Q2

Liferay DXP 2024.Q3

Liferay DXP 2024.Q4

Liferay DXP 2025.Q1

Liferay DXP 2025.Q2

Liferay DXP 2025.Q3

Liferay Faces Alloy 2.0

Liferay Faces Alloy 3.0

Liferay Portal 7.0

Liferay Portal 7.1

Liferay Portal 7.2

Liferay Portal 7.3

Liferay Portal 7.4

Liferay Portal 7.4.3

Found a Bug?

Found a Security Vulnerability?

Hall of Fame!