Known Vulnerabilities

A memory leak in the headless API for StructuredContents in Liferay Portal and Liferay DXP allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Liferay Portal 7.4.3.132 Liferay DXP 2025.Q1.0 Liferay DXP 2024.Q1.13 Liferay DXP 2024.Q4.4 Liferay Portal 7.4.3.121 through 7.3.3.131 Liferay DXP 2024.Q1.1 through 2024.Q1.12 Liferay DXP 2024.Q2.0...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2 Liferay DXP 2024 Q3 Liferay DXP 2024.Q4
Liferay Portal 7.4.3.113 Liferay DXP 2024.Q2.0 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.9 Liferay Portal 7.2.0 through 7.4.3.112 Liferay DXP 2023.Q4.0 through 2023.Q4.8 Liferay DXP 2023.Q3.1...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2024.Q2.0 Liferay Portal 7.4.3.113 Liferay DXP 2023.Q4.8 Liferay DXP 2024.Q1.1 Batch Engine in Liferay Portal and Liferay DXP does not properly check permission with import and export...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2023.Q3.9 Liferay DXP 2023.Q4.8 Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal and Liferay DXP allows remote attackers to...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 Liferay Portal 6.2 CE LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the...

Releases: Liferay Portal 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal and Liferay DXP does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page templates via crafted...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Unchecked input for loop condition vulnerability in XML-RPC in Liferay Portal and Liferay DXP allows remote attackers to perform a denial-of-service (DoS) attacks via a crafted XML-RPC request....

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
In Liferay Portal and Liferay DXP, the default membership type of a newly created site is “Open” which allows any registered users to become a member of the site. A remote attacker with site...

Releases: Liferay Portal 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP allows a time-based one-time password (TOTP) to be used multiple times during the validity period, which allows attackers with access to a user’s TOTP to authenticate as the user....

Releases: Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q3.5 Liferay DXP 2023.Q4.1 Liferay Portal 7.4.3.112 Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal and Liferay DXP allows remote...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a "Rich Text"...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Remote staging in Liferay DXP does not properly obtain the remote address of the live site from the database which, which allows remote authenticated users to exfiltrate data to an attacker...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal and Liferay DXP may incorrectly identify the subdomain of a domain name and create a supercookie, which allows remote attackers who control a website that share the same TLD to read...

Releases: Liferay Portal 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Liferay DXP 2023.Q4.1 Liferay DXP 2024.Q1.1 Liferay DXP 7.3 U36 Liferay DXP 2023.Q3.5 Stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote authenticated...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 7.3 U36 Liferay DXP 2023.Q3.5 Liferay Portal and Liferay DXP does not limit the number of objects returned from a GraphQL queries, which allows remote attackers to perform...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
A Stored cross-site scripting vulnerability in the Liferay Portal and Liferay DXP allows an remote authenticated attacker to inject JavaScript through the organization site names. The malicious...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2 Liferay DXP 2024 Q3 Liferay DXP 2024.Q4 Liferay DXP 2025.Q1 Liferay DXP 2025.Q2 Liferay DXP 2025.Q3
Reflected cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via the /c/portal/comment/discussion/get_editor...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2 Liferay DXP 2024 Q3
Improper Access Control vulnerability in Liferay Portal and Liferay DXP allows guest users to obtain object entries information via the API Builder. Liferay Portal 7.4.3.125 Liferay DXP 2024.Q1.13...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2
Liferay Portal 7.4.3.45 through 7.4.3.125 Liferay DXP 7.4 U45 through U92 Liferay DXP 2024.Q1.1 through 2024.Q1.12 Liferay DXP 2024.Q2.0 through 2024.Q2.9 Liferay Portal 7.4.3.129 Liferay Portal...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2

Showing 21 to 40 of 499 entries.

1
2
3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
25

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Learn More >

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Learn More >

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!

Learn More >

Community

Company

Feedback

Known Vulnerabilities

Liferay DXP 7.1

Liferay DXP 7.2

Liferay DXP 7.3

Liferay DXP 7.4

Liferay DXP 2023.Q3

Liferay DXP 2023.Q4

Liferay DXP 2024.Q1

Liferay DXP 2024.Q2

Liferay DXP 2024.Q3

Liferay DXP 2024.Q4

Liferay DXP 2025.Q1

Liferay DXP 2025.Q2

Liferay DXP 2025.Q3

Liferay Faces Alloy 2.0

Liferay Faces Alloy 3.0

Liferay Portal 7.0

Liferay Portal 7.1

Liferay Portal 7.2

Liferay Portal 7.3

Liferay Portal 7.4

Liferay Portal 7.4.3

Found a Bug?

Found a Security Vulnerability?

Hall of Fame!