Known Vulnerabilities

Liferay DXP 2023.Q4.6 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q3.9 This issue was reported by foobar7 Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2023.Q4.6 Liferay DXP 2024.Q1.1 Liferay DXP 2023.Q3.9 This issue was reported by foobar7 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay DXP allow remote...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2023.Q3.9 This issue was reported by foobar7 Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay DXP allows remote attackers to inject arbitrary...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
This issue was reported by foobar7 Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal and Liferay DXP allows remote authenticated attackers to...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Multiple cross-site scripting (XSS) vulnerabilities with Calendar events in Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay DXP allow remote attackers to inject arbitrary web script or HTML via a crafted...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay DXP allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Calendar's “Name”...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Severity 2 Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal and Liferay DXP allows remote attackers to (1) change user passwords, (2) shut down the server,...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4 Liferay DXP 2024 Q1
Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal and Liferay DXP allows remote attackers to (1) change user passwords, (2) shut down the server, (3)...

Releases: Liferay Portal 7.4 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Severity 2 Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal and Liferay DXP allows remote attackers to (1) change user passwords, (2) shut down the...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.4.3.102 through 7.4.3.110 Liferay DXP 2023.Q4.0 through 2023.Q4.2 Liferay DXP 2023.Q3.5 Liferay Portal 7.4.3.111 Liferay Portal 7.4.3.111 Liferay DXP 2024.Q1.1 Liferay DXP...

Releases: Liferay Portal 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay Portal 7.4.0 through 7.4.3.111 Liferay Portal 7.3.2 through 7.3.7 Liferay DXP 2023.Q4.0 through 2023.Q4.5 Liferay DXP 2023.Q3.1 through 2023.Q3.8 Liferay DXP 7.4 Liferay DXP 7.3 Liferay...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay DXP 7.3 Liferay DXP 7.4 Liferay DXP 2023.Q3 Liferay DXP 2023.Q4
Liferay DXP 2023.Q3.6 This issue was reported by Erwin Krazek Severity 1 Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal and Liferay DXP allows...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3
Severity 2 The Account Settings page in Liferay Portal and Liferay DXP embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed...

Releases: Liferay Portal 7.4 Liferay DXP 7.4 Liferay DXP 2023.Q3
Liferay Portal 7.4.3.38 Liferay Portal 7.4.3.38 Liferay DXP 7.4 update 38 Liferay DXP 7.3 update 11 Liferay DXP 7.2 fix pack 20 Liferay DXP 7.3 update 11 Liferay DXP 7.4 update 38 Liferay DXP 7.2...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4
Liferay DXP 7.3 update 8 Liferay DXP 7.4 update 27 Liferay DXP 7.2 fix pack 20 This issue was reported by Barnabás Horváth (T4r0) Severity 2 User enumeration vulnerability in Liferay Portal and...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4
Workaround: Set the following in portal(-ext).properties: http.header.version.verbosity=partial Liferay DXP 7.2 fix pack 19 Severity 2 In Liferay Portal and Liferay DXP the default value of the...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4
This issue was reported by: Sompo Digital Lab Tel Aviv, Asaf Guterman Severity 2 Privilege escalation vulnerability in Wiki in Liferay Portal and Liferay DXP allows remote authenticated users to...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4
Severity 1 Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4
Severity 2 The Image Uploader module in Liferay Portal and Liferay DXP relies on a request parameter to limit the size of files that can be uploaded, which allows remote authenticated users to...

Releases: Liferay Portal 7.4 Liferay Portal 7.3 Liferay Portal 7.2 Liferay DXP 7.2 Liferay DXP 7.3 Liferay DXP 7.4

Showing 141 to 160 of 499 entries.

1
- 2
- 3
- 4
- 5
- 6
7
8
9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
25

Found a Bug?

If you have found, or think you have found a bug, help us to help you by letting us know!

Learn More >

Found a Security Vulnerability?

There's a different process available if you have a security issue to report...

Learn More >

Hall of Fame!

Raise your profile - report security vulnerabilities and enter the Hall of Fame!

Learn More >

Community

Company

Feedback

Known Vulnerabilities

Liferay DXP 7.1

Liferay DXP 7.2

Liferay DXP 7.3

Liferay DXP 7.4

Liferay DXP 2023.Q3

Liferay DXP 2023.Q4

Liferay DXP 2024.Q1

Liferay DXP 2024.Q2

Liferay DXP 2024.Q3

Liferay DXP 2024.Q4

Liferay DXP 2025.Q1

Liferay DXP 2025.Q2

Liferay DXP 2025.Q3

Liferay Faces Alloy 2.0

Liferay Faces Alloy 3.0

Liferay Portal 7.0

Liferay Portal 7.1

Liferay Portal 7.2

Liferay Portal 7.3

Liferay Portal 7.4

Liferay Portal 7.4.3

Found a Bug?

Found a Security Vulnerability?

Hall of Fame!