Vulnerabilities > Liferay

DATE CVE VULNERABILITY TITLE RISK
2023-05-24 CVE-2023-33941 Cross-site Scripting vulnerability in Liferay Digital Experience Platform and Liferay Portal
Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.
network
low complexity
liferay CWE-79
6.1
2023-05-24 CVE-2023-33942 Cross-site Scripting vulnerability in Liferay Digital Experience Platform and Liferay Portal
Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.
network
low complexity
liferay CWE-79
5.4
2023-05-24 CVE-2023-33943 Cross-site Scripting vulnerability in Liferay Digital Experience Platform and Liferay Portal
Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.
network
low complexity
liferay CWE-79
5.4
2023-05-24 CVE-2023-33938 Cross-site Scripting vulnerability in Liferay Digital Experience Platform and Liferay Portal
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
network
low complexity
liferay CWE-79
6.1
2023-05-24 CVE-2023-33939 Cross-site Scripting vulnerability in Liferay Digital Experience Platform and Liferay Portal
Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.
network
low complexity
liferay CWE-79
5.4
2023-05-24 CVE-2023-33940 Cross-site Scripting vulnerability in Liferay Digital Experience Platform and Liferay Portal
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.
network
low complexity
liferay CWE-79
5.4
2023-05-24 CVE-2023-33937 Cross-site Scripting vulnerability in Liferay Digital Experience Platform and Liferay Portal
Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field.
network
low complexity
liferay CWE-79
5.4
2023-04-16 CVE-2021-33990 Improper Preservation of Permissions vulnerability in Liferay Portal 6.2.5
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists.
network
low complexity
liferay CWE-281
critical
9.8
2022-11-15 CVE-2022-42129 Authorization Bypass Through User-Controlled Key vulnerability in Liferay Digital Experience Platform and Liferay Portal
An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before update 4, and 7.4 GA allows remote authenticated users to view and access form entries via the `formInstanceRecordId` parameter.
network
low complexity
liferay CWE-639
4.3
2022-11-15 CVE-2022-42130 Incorrect Default Permissions vulnerability in Liferay Digital Experience Platform and Liferay Portal
The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
network
low complexity
liferay CWE-276
4.3