Known Vulnerabilities

The Commerce component in Liferay Portal and Liferay DXP saves virtual products uploaded to Documents and Media with guest view permission, which allows remote attackers to access and download...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Open redirect vulnerability in the System Settings in Liferay Portal and Liferay DXP allows remote attackers to redirect users to arbitrary external URLs via the...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3
This issue was reported by milCERT AT and Abderrahmane BOUNHIDJA Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal and Liferay DXP allows remote...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0
Open redirect vulnerability in page administration in Liferay Portal and Liferay DXP allows remote attackers to redirect users to arbitrary external URLs via the...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0 Liferay DXP 2023.Q3
Liferay Portal and Liferay DXP does not limit the depth of a GraphQL queries, which allows remote attackers to perform denial-of-service (DoS) attacks on the application by executing complex...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3
Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal and Liferay DXP allows remote attackers to access arbitrary CSS and JSS files and load the files...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter to (1)...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.4.3.22 Liferay DXP 7.4 Update 10 Liferay DXP 7.3 Update 26 Liferay Portal 7.0.0 through 7.4.3.21 Liferay DXP 7.4 GA through Update 9 Liferay DXP 7.3 GA through Update 25 Liferay...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 Liferay Portal 6.2 CE LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0
Liferay DXP 7.3 update 28 Liferay DXP 7.4 update 1 Kaleo Forms Admin in Liferay Portal and Liferay DXP does not restrict the saving of request parameters in the portlet session, which allows...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4
In Liferay Portal and Liferay DXP (Liferay PaaS, and Liferay Self-Hosted), the Objects module does not restrict the use of Groovy scripts in Object actions for Admin Users. This allows remote...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Insufficient CSRF protection for omni-administrator users in Liferay Portal and Liferay DXP allows attackers to execute Cross-Site Request Forgery Liferay Portal 7.0.0 through 7.4.3.119 Liferay DXP...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 Liferay Portal 6.2 CE LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Severity 1 Liferay Portal 7.4.3.102 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.0 Liferay DXP 2023.Q3.5 Liferay DXP 7.3 Update 36 Liferay Portal 7.4.0 through 7.4.3.101 Liferay Portal 7.3.0 through...

Releases: Liferay Portal 7.4 Liferay Portal 6.2 CE LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4 LIferay DXP 7.0 Liferay DXP 2023.Q3
Liferay Portal and Liferay DXP does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API. Liferay DXP 2023.Q3.1...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay Portal 7.1 Liferay Portal 7.0 LIferay DXP 7.1 Liferay DXP 7.2 Liferay DXP 7.3 LIferay DXP 7.0 Liferay DXP 2023.Q3
Liferay Portal 7.4.3.110 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.1 Liferay DXP 2023.Q3.5 Liferay DXP 7.3 Update 36 Liferay DXP 2023.Q3.1 through 2023.Q3.4 Liferay DXP 7.4 Update 51 through Update...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal and Liferay DXP allows remote authenticated users to from one account to view addresses from a...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
This issue was reported by foobar7 Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal and Liferay DXP allows remote authenticated attackers to view publication...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal and Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.4.3.21 through 7.4.3.111 Liferay DXP 2023.Q4.0 through 2023.Q4.5 Liferay DXP 2023.Q3.1 through 2023.Q3.8 Liferay DXP 7.4 Update 21 through Update 92 Liferay Portal 7.4.3.112...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.4.3.112 Liferay Portal 7.4.3.112 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q4.6 Liferay DXP 2023.Q3.9 Liferay DXP 2023.Q4.6 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q3.9 This issue was...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4

Showing 121 to 140 of 499 entries.

1
- 2
- 3
- 4
- 5
6
7
8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
25

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Learn More >

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Learn More >

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!

Learn More >

Community

Company

Feedback

Known Vulnerabilities

Liferay DXP 7.1

Liferay DXP 7.2

Liferay DXP 7.3

Liferay DXP 7.4

Liferay DXP 2023.Q3

Liferay DXP 2023.Q4

Liferay DXP 2024.Q1

Liferay DXP 2024.Q2

Liferay DXP 2024.Q3

Liferay DXP 2024.Q4

Liferay DXP 2025.Q1

Liferay DXP 2025.Q2

Liferay DXP 2025.Q3

Liferay Faces Alloy 2.0

Liferay Faces Alloy 3.0

Liferay Portal 7.0

Liferay Portal 7.1

Liferay Portal 7.2

Liferay Portal 7.3

Liferay Portal 7.4

Liferay Portal 7.4.3

Found a Bug?

Found a Security Vulnerability?

Hall of Fame!