Known Vulnerabilities

This issue was reported by milCERT AT and Lucas Machado from Devoteam Cyber Trust A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2 Liferay DXP 2024 Q3 Liferay DXP 2024.Q4
Stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to execute arbitrary web script or HTML via components tab. Liferay Portal 7.4.0 through...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2 Liferay DXP 2024 Q3
Stored cross-site scripting (XSS) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via remote app title field. Liferay Portal 7.4.0...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2024 Q1 Liferay DXP 2024 Q2 Liferay DXP 2024 Q3
Liferay Portal 7.4.0 through 7.4.3.38 Liferay DXP 7.4 GA through Update 38 Liferay Portal 7.4.3.39 Liferay Portal 7.4.3.39 Liferay DXP 7.4 Update 39 Liferay DXP 7.4 Update 39 This issue was...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4
Liferay DXP 2024.Q1.1 Liferay Portal 7.4.3.112 Liferay DXP 2023.Q3.5 Liferay DXP 2023.Q4.1 Liferay DXP 7.3 U36 This issue was reported by 4rth4s Liferay Portal and Liferay DXP does not limit access...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
The Profile widget in Liferay Portal and Liferay DXP uses a user’s name in the “Content-Disposition” header, which allows remote authenticated users to change the file extension when a vCard file...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal and Liferay DXP allows remote attackers to view contact information, including the contact’s...

Releases: Liferay Portal 7.4 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2023.Q3.9 Liferay DXP 2023.Q4.6 Liferay DXP 7.3 update 36 This issue was reported by foobar7 Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal and Liferay DXP...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.4.3.112 Liferay Portal 7.4.3.112 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.6 Liferay DXP 2023.Q4.6 Liferay DXP 2024.Q1.1 This issue was reported by foobar7 Multiple cross-site...

Releases: Liferay Portal 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.3.1 through 7.4.3.111 Liferay DXP 2023.Q4.0 through 2023.Q4.5 Liferay DXP 2023.Q3.1 through 2023.Q3.8 Liferay DXP 7.4 Liferay DXP 7.3 Liferay Portal 7.4.3.112 Liferay Portal...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2023.Q4.6 This issue was reported by foobar7 Cross-site request forgery (CSRF) vulnerability in Liferay Portal and Liferay DXP allows remote attackers to add and edit publication...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.4.0 through 7.4.3.112 Liferay DXP 2023.Q4.0 through 2023.Q4.8 Liferay DXP 2023.Q3.1 through 2023.Q3.10 Liferay DXP 7.4 Liferay Portal 7.4.3.113 Liferay Portal 7.4.3.113 Liferay DXP...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP allows remote authenticated users to from one virtual instance to view the shipment addresses of...

Releases: Liferay DXP 2023.Q4
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal and Liferay DXP allows remote authenticated users to from one virtual instance to view the audit events...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Liferay DXP 2024.Q1.3 Liferay DXP 2024.Q2.0 Liferay DXP 2023.Q4.9 This issue was reported by argon21 Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Liferay DXP 2023.Q3.9 This issue was reported by foobar7 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote authenticated users to inject...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal and Liferay DXP allows remote authenticated users in one virtual instance to assign an organization to a user in a different...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
This issue was reported by argon21 Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4

Showing 101 to 120 of 499 entries.

1
- 2
- 3
- 4
5
6
7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
25

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Learn More >

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Learn More >

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!

Learn More >

Community

Company

Feedback

Known Vulnerabilities

Liferay DXP 7.1

Liferay DXP 7.2

Liferay DXP 7.3

Liferay DXP 7.4

Liferay DXP 2023.Q3

Liferay DXP 2023.Q4

Liferay DXP 2024.Q1

Liferay DXP 2024.Q2

Liferay DXP 2024.Q3

Liferay DXP 2024.Q4

Liferay DXP 2025.Q1

Liferay DXP 2025.Q2

Liferay DXP 2025.Q3

Liferay Faces Alloy 2.0

Liferay Faces Alloy 3.0

Liferay Portal 7.0

Liferay Portal 7.1

Liferay Portal 7.2

Liferay Portal 7.3

Liferay Portal 7.4

Liferay Portal 7.4.3

Found a Bug?

Found a Security Vulnerability?

Hall of Fame!