Vulnerabilities > Liferay
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-10-04 | CVE-2019-16891 | Deserialization of Untrusted Data vulnerability in Liferay Portal Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. | 9.8 |
| 2019-09-09 | CVE-2019-16147 | Cross-site Scripting vulnerability in Liferay Portal Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib. | 6.1 |
| 2019-06-03 | CVE-2019-6588 | Cross-site Scripting vulnerability in Liferay Portal In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. | 4.7 |
| 2019-04-22 | CVE-2019-11444 | OS Command Injection vulnerability in Liferay Portal 7.1.2 An issue was discovered in Liferay Portal CE 7.1.2 GA3. | 7.2 |
| 2018-05-07 | CVE-2018-10795 | Unrestricted Upload of File with Dangerous Type vulnerability in Liferay Portal Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment via a browser/liferay/browser.html?Type= or html/js/editor/fckeditor/editor/filemanager/browser/liferay/browser.html URI. | 8.8 |
| 2018-01-02 | CVE-2017-1000425 | Cross-site Scripting vulnerability in Liferay Portal Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter. | 6.1 |
| 2017-12-27 | CVE-2017-17868 | Cross-site Scripting vulnerability in Liferay Portal 6.1.0 In Liferay Portal 6.1.0, the tags section has XSS via a Public Render Parameter (p_r_p) value, as demonstrated by p_r_p_564233524_tag. | 6.1 |
| 2017-08-07 | CVE-2017-12649 | Cross-site Scripting vulnerability in Liferay Portal 6.1.2/6.2.2/7.0 XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display. | 6.1 |
| 2017-08-07 | CVE-2017-12648 | Cross-site Scripting vulnerability in Liferay Portal 6.1.2/6.2.2/7.0 XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL. | 6.1 |
| 2017-08-07 | CVE-2017-12647 | Cross-site Scripting vulnerability in Liferay Portal 6.1.2/6.2.2/7.0 XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title. | 6.1 |