Vulnerabilities > Liferay > Liferay Portal > 7.3.7
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-09-22 | CVE-2022-28980 | Cross-site Scripting vulnerability in Liferay Portal Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix. | 6.1 |
| 2022-09-22 | CVE-2022-28978 | Cross-site Scripting vulnerability in Liferay DXP 7.0/7.2 Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Portal 7.0.1 through 7.4.1, and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name. | 5.4 |
| 2022-09-22 | CVE-2022-28979 | Cross-site Scripting vulnerability in Liferay DXP and Liferay Portal Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. | 6.1 |
| 2022-09-22 | CVE-2022-28982 | Cross-site Scripting vulnerability in Liferay DXP and Liferay Portal A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag. | 6.1 |
| 2022-09-22 | CVE-2022-39975 | Missing Authorization vulnerability in Liferay DXP and Liferay Portal The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation. | 4.3 |
| 2022-04-25 | CVE-2022-26597 | Cross-site Scripting vulnerability in Liferay Digital Experience Platform 7.0/7.3 Cross-site scripting (XSS) vulnerability in the Layout module's Open Graph integration in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the site name. | 6.1 |
| 2022-04-19 | CVE-2022-26595 | Incorrect Default Permissions vulnerability in Liferay Digital Experience Platform and Liferay Portal Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI. | 4.3 |