Search for packages
| purl | pkg:maven/com.liferay.portal/release.dxp.bom@7.0.10.fp81 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-f43m-hhj4-q3jg
Aliases: CVE-2022-42132 |
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL The Test LDAP Users functionality in Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-w7f2-6896-6mm2
Aliases: CVE-2022-26596 |
Liferay Portal and Liferay DXP allows arbitrary injection via web content template names Cross-site scripting (XSS) vulnerability in Journal module's … |
Vulnerable |
|
GHSA-g7xc-m762-wg8f
Aliases: CVE-2021-33333 |
Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions The Portal Workflow module in Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-87x7-pwrx-jch7
Aliases: CVE-2021-29040 |
Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages The JSON web services in Liferay Portal 7.3.4 … |
Vulnerable |
|
GHSA-mg3r-9jh8-33r9
Aliases: CVE-2020-15842 |
Liferay Portal and Liferay DXP have Insecure Deserialization Vulnerability Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack … |
Vulnerable |
|
GHSA-v377-8f8f-532h
Aliases: CVE-2020-13445 |
Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before … |
Vulnerable |
|
GHSA-hgjv-7wjr-qwqp
Aliases: CVE-2021-33326 |
Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module Cross-site scripting (XSS) vulnerability in the … | There are no reported fixed by versions. |
|
GHSA-82j7-2h3j-hc7f
Aliases: CVE-2021-29041 |
Liferay DXP Vulnerable to Denial-of-service (DoS) in the Multi-Factor Authentication Module Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in … |
Vulnerable |
|
GHSA-8j5r-9687-88w5
Aliases: CVE-2020-13444 |
Liferay Portal and Liferay DXP Fails to Sanitize API Data Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before … |
Vulnerable |
|
GHSA-pr7v-qv65-rp9m
Aliases: CVE-2021-29052 |
Liferay Portal and Liferay DXP Fails to Check Permissions The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and … |
Vulnerable |
|
GHSA-f9wj-c5pc-g9rh
Aliases: CVE-2021-29053 |
Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay … |
Vulnerable |
|
GHSA-wg4x-hf94-fj5v
Aliases: CVE-2021-33320 |
Liferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rate The Flags module before version 5.0.11 … | There are no reported fixed by versions. |
|
GHSA-wcr5-3q96-c2gr
Aliases: CVE-2021-29044 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-vrwx-q9pj-x488
Aliases: CVE-2020-15840 |
Liferay Portal and Liferay DXP Bypass via Double Encoded URL In Liferay Portal before 7.3.1, com.liferay.portal:com.liferay.portal.impl before 7.1.3 and 7.4.0, … | There are no reported fixed by versions. |
|
GHSA-9mxg-p873-6793
Aliases: CVE-2021-29047 |
Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 … |
Vulnerable |
|
GHSA-w28v-87g6-cjr6
Aliases: CVE-2021-29049 |
Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL Parameter Cross-site scripting (XSS) vulnerability in the Portal Workflow module's … | There are no reported fixed by versions. |
|
GHSA-773f-f929-qgjj
Aliases: CVE-2020-15841 |
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection Liferay Portal before 7.3.0, and Liferay DXP … |
Vulnerable |
|
GHSA-6c88-gvxw-f5hg
Aliases: CVE-2021-33325 |
Liferay Portal and Liferay DXP Stores User Passwords in Cleartext The Portal Workflow module in Liferay Portal 7.3.2 and earlier, … | There are no reported fixed by versions. |
|
GHSA-g37f-j8hh-736f
Aliases: CVE-2021-33334 |
Liferay Portal and Liferay DXP Fails to Properly Check User Permissions The Dynamic Data Mapping module in Liferay Portal 7.0.0 … |
Vulnerable |
|
GHSA-mj8w-h522-jwm8
Aliases: CVE-2021-33331 |
Liferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs Open redirect vulnerability in the Notifications module … |
Vulnerable |
|
GHSA-vwj8-4grf-3r8v
Aliases: CVE-2021-33322 |
Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use In implementation for the portal services before … | There are no reported fixed by versions. |
|
GHSA-vpvm-3wfw-5f5c
Aliases: CVE-2021-33328 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page Cross-site scripting (XSS) vulnerability in the … | There are no reported fixed by versions. |
|
GHSA-jp3m-vh3g-6ggp
Aliases: CVE-2021-38266 |
Liferay Portal and Liferay DXP fails to properly import users from LDAP Security LDAP Implementation before 2.0.16 from Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-ghw5-998m-vw4w
Aliases: CVE-2022-25146 |
Liferay Portal and Liferay DXP fails to check origin of event messages The Remote App module before 2.0.21 from Liferay … |
Vulnerable |
|
GHSA-f855-2rvm-5j7h
Aliases: CVE-2021-38268 |
Liferay Portal and Liferay DXP has incorrect default permissions for site members The Dynamic Data Mapping module before 4.0.39 from … |
Vulnerable |
|
GHSA-3x83-whxw-pvmg
Aliases: CVE-2021-38265 |
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) Liferay Layout Admin Web before 5.0.0 in Liferay Portal v7.3.6 … | There are no reported fixed by versions. |
|
GHSA-8mp9-w7gr-pvj3
Aliases: CVE-2022-28980 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix Multiple cross-site scripting (XSS) vulnerabilities in Liferay Fragment … | There are no reported fixed by versions. |
|
GHSA-7m65-hmvg-rxpc
Aliases: CVE-2022-28978 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module Stored cross-site scripting (XSS) vulnerability in the Site … |
Vulnerable |
|
GHSA-chj2-4vg7-hhg3
Aliases: CVE-2024-8980 |
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console The Script Console in Liferay Portal 7.0.0 through … | There are no reported fixed by versions. |
|
GHSA-px38-239g-x5mg
Aliases: CVE-2023-37940 |
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-43h9-p3j4-39hm
Aliases: CVE-2024-25607 |
Liferay Portal defaults to a low work factor for the default password hashing algorithm The default password hashing algorithm (PBKDF2-HMAC-SHA1) … |
Vulnerable |
|
GHSA-mf8h-grfg-j9j3
Aliases: CVE-2024-25605 |
Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API The Journal module in Liferay … |
Vulnerable |
|
GHSA-2mvj-q2q3-wxjv
Aliases: CVE-2024-26267 |
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, … |
Vulnerable |
|
GHSA-4585-28v2-8h46
Aliases: CVE-2024-25150 |
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel Information disclosure vulnerability in the Control Panel in … |
Vulnerable |
|
GHSA-869h-qhfx-w939
Aliases: CVE-2024-25606 |
Liferay Portal has an XXE vulnerability in Java2WsddTask._format XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, … |
Vulnerable |
|
GHSA-mwhf-6mjm-6w3h
Aliases: CVE-2021-29038 |
Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers In Liferay Impl before 5.18.4, Liferay Users Admin Web … |
Vulnerable |
|
GHSA-pw7p-3648-qqmg
Aliases: CVE-2024-25604 |
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions Liferay Portal 7.2.0 through 7.4.3.4, and … |
Vulnerable |
|
GHSA-548x-j6x6-hcv4
Aliases: CVE-2024-25608 |
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and … |
Vulnerable |
|
GHSA-qm43-g2xj-hvg5
Aliases: CVE-2024-26268 |
Liferay Portal and Liferay DXP User Enumeration Vulnerability User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported … |
Vulnerable |
|
GHSA-qpgh-6v9w-vfv6
Aliases: CVE-2024-25149 |
Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options Liferay Portal … |
Vulnerable |
|
GHSA-vvpf-53qx-cxhh
Aliases: CVE-2024-25610 |
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported … |
Vulnerable |
|
GHSA-9vgq-w5pv-v77q
Aliases: CVE-2024-25145 |
Liferay Portal stored cross-site scripting (XSS) vulnerability Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app … |
Vulnerable |
|
GHSA-222w-xmc5-jhp3
Aliases: CVE-2025-43735 |
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability A reflected cross-site scripting (XSS) vulnerability in the Liferay … | There are no reported fixed by versions. |
|
GHSA-cg99-m88x-422c
Aliases: CVE-2025-43736 |
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability A Denial Of Service via … | There are no reported fixed by versions. |
|
GHSA-c6g5-g6r7-q4j6
Aliases: CVE-2025-4655 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery An SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 … | There are no reported fixed by versions. |
|
GHSA-m5c7-5gv3-hcpf
Aliases: CVE-2025-43734 |
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability A reflected cross-site scripting (XSS) vulnerability in … |
Vulnerable Vulnerable |
|
GHSA-6v93-frf9-2rp8
Aliases: CVE-2025-4581 |
Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through … | There are no reported fixed by versions. |
|
GHSA-c7f6-4vx5-4263
Aliases: CVE-2020-15839 |
Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP Liferay Portal before 7.3.3, and Liferay DXP … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-474f-cmx5-gm69
Aliases: CVE-2021-33324 |
Liferay Portal and Liferay DXP Don't Check Permissions of Pages The Layout module in Liferay Portal 7.1.0 through 7.3.1, and … |
Vulnerable Vulnerable |
|
GHSA-xx2h-2hf5-v7vv
Aliases: CVE-2021-29043 |
Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password The Portal Store module in Liferay Portal 7.0.0 through … |
Vulnerable Vulnerable |
|
GHSA-4fx8-82f3-xcpc
Aliases: CVE-2021-29048 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page Cross-site scripting (XSS) vulnerability in … |
Vulnerable Vulnerable |
|
GHSA-jvvx-8g42-9559
Aliases: CVE-2021-29051 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App Cross-site scripting (XSS) vulnerability in the … | There are no reported fixed by versions. |