Vulnerabilities > Liferay > DXP

DATE CVE VULNERABILITY TITLE RISK
2024-02-08 CVE-2024-25144 Excessive Iteration vulnerability in Liferay DXP 7.2/7.3/7.4
The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 6, 7.2 before fix pack 19, and older unsupported versions does not check the URL of the IFrame, which allows remote authenticated users to cause a denial-of-service (DoS) via a self referencing IFrame.
network
low complexity
liferay CWE-834
6.5
2024-02-08 CVE-2024-25146 Information Exposure Through Discrepancy vulnerability in Liferay DXP and Liferay Portal
Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with different responses depending on whether a site does not exist or if the user does not have permission to access the site, which allows remote attackers to discover the existence of sites by enumerating URLs.
network
low complexity
liferay CWE-203
5.3
2024-02-08 CVE-2024-25148 Unspecified vulnerability in Liferay DXP and Liferay Portal
In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions the `doAsUserId` URL parameter may get leaked when creating linked content using the WYSIWYG editor and while impersonating a user.
network
low complexity
liferay
8.1
2024-02-07 CVE-2024-25145 Cross-site Scripting vulnerability in Liferay DXP
Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML into the Search Result app's search result if highlighting is disabled by adding any searchable content (e.g., blog, message board message, web content article) to the application.
network
low complexity
liferay CWE-79
5.4
2023-06-15 CVE-2023-35030 Cross-Site Request Forgery (CSRF) vulnerability in Liferay DXP and Liferay Portal
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
network
low complexity
liferay CWE-352
8.8
2023-06-15 CVE-2023-35029 Open Redirect vulnerability in Liferay DXP and Liferay Portal
Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
network
low complexity
liferay CWE-601
6.1
2023-06-15 CVE-2023-3193 Cross-site Scripting vulnerability in Liferay DXP and Liferay Portal
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
network
low complexity
liferay CWE-79
6.1
2022-11-15 CVE-2022-42111 Cross-site Scripting vulnerability in Liferay DXP and Liferay Portal
A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.
network
low complexity
liferay CWE-79
5.4
2022-11-15 CVE-2022-42118 Cross-site Scripting vulnerability in Liferay Portal
A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
network
low complexity
liferay CWE-79
6.1
2022-11-15 CVE-2022-42119 Cross-site Scripting vulnerability in Liferay DXP and Liferay Portal
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module.
network
low complexity
liferay CWE-79
5.4