Search for packages
| purl | pkg:maven/com.liferay.portal/com.liferay.portal.impl@5.3.2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-6533-fhr2-f38h
Aliases: CVE-2025-62276 |
Liferay Portal and DXP use an incorrect cache-control header The Document Library and the Adaptive Media modules in Liferay Portal … |
Vulnerable |
|
GHSA-xcj6-xpjg-c4xr
Aliases: CVE-2025-62261 |
Liferay Portal Stores Password Reset Tokens in Plain Text Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay … |
Vulnerable |
|
GHSA-pfwq-mr9g-gq6m
Aliases: CVE-2025-62252 |
Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through … |
Vulnerable |
|
GHSA-rx48-gqc2-4w47
Aliases: CVE-2025-62249 |
Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-q95h-87j6-273x
Aliases: CVE-2025-62254 |
Liferay Portal ComboServlet denial of service via large file combination The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older … |
Vulnerable |
|
GHSA-cv9j-mg9w-v7wm
Aliases: CVE-2025-43768 |
Liferay Portal JSONWS API endpoint shares sensitive information Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 … |
Vulnerable |
|
GHSA-95h4-8mqc-4mpf
Aliases: CVE-2025-43801 |
Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC Unchecked input for loop condition vulnerability in XML-RPC in … |
Vulnerable |
|
GHSA-xvgg-9h29-4g34
Aliases: CVE-2025-43793 |
Liferay Portal has Improper Validation of Specified Quantity in Input Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and … |
Vulnerable |
|
GHSA-r45v-2289-jgr4
Aliases: CVE-2025-43794 |
Liferay Portal has stored cross-site scripting (XSS) vulnerability A stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, … |
Vulnerable |
|
GHSA-697h-3q6m-jwp4
Aliases: CVE-2025-43809 |
Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay … |
Vulnerable |
|
GHSA-9427-7f65-88c8
Aliases: CVE-2022-41414 |
Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 … |
Vulnerable |
|
GHSA-822f-jfpg-hg7h
Aliases: CVE-2022-26595 |
Liferay Portal and Liferay DXP fails to check permissions to view sites/groups Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay … | There are no reported fixed by versions. |
|
GHSA-jfch-m2x3-2v66
Aliases: CVE-2021-33321 |
Liferay Portal and Liferay DXP insecure default configuration Insecure default configuration in portal services implementation before 5.11.0 in Liferay Portal … |
Vulnerable |
|
GHSA-vrwx-q9pj-x488
Aliases: CVE-2020-15840 |
Liferay Portal and Liferay DXP Bypass via Double Encoded URL In Liferay Portal before 7.3.1, com.liferay.portal:com.liferay.portal.impl before 7.1.3 and 7.4.0, … |
Vulnerable |
|
GHSA-vwj8-4grf-3r8v
Aliases: CVE-2021-33322 |
Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use In implementation for the portal services before … |
Vulnerable |
|
GHSA-mh9r-9pcx-rx55
Aliases: CVE-2021-29050 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page Cross-Site Request Forgery (CSRF) vulnerability … |
Vulnerable |
|
GHSA-2hm7-r8f3-423h
Aliases: CVE-2025-43813 |
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet Possible path traversal vulnerability and denial-of-service in the ComboServlet … |
Vulnerable Vulnerable |