Search for packages
| purl | pkg:maven/com.liferay.portal/release.dxp.bom@7.2.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-f43m-hhj4-q3jg
Aliases: CVE-2022-42132 |
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL The Test LDAP Users functionality in Liferay Portal … |
Vulnerable |
|
GHSA-gxxj-fhmr-37j9
Aliases: CVE-2022-42121 |
Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module A SQL injection vulnerability in the Layout … |
Vulnerable |
|
GHSA-p768-r2m2-8vjr
Aliases: CVE-2022-42111 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Sharing Module A Cross-site scripting (XSS) vulnerability in the Sharing … |
Vulnerable |
|
GHSA-mr77-4pm4-x9vm
Aliases: CVE-2022-42118 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module A Cross-site scripting (XSS) vulnerability in the … |
Vulnerable |
|
GHSA-2qwm-9mg5-jwq8
Aliases: CVE-2022-42110 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module A Cross-site scripting (XSS) vulnerability in the Announcements … |
Vulnerable |
|
GHSA-7f7g-vhff-mjqj
Aliases: CVE-2022-42112 |
Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module A Cross-site scripting (XSS) vulnerability in the … |
Vulnerable |
|
GHSA-w7f2-6896-6mm2
Aliases: CVE-2022-26596 |
Liferay Portal and Liferay DXP allows arbitrary injection via web content template names Cross-site scripting (XSS) vulnerability in Journal module's … |
Vulnerable |
|
GHSA-822f-jfpg-hg7h
Aliases: CVE-2022-26595 |
Liferay Portal and Liferay DXP fails to check permissions to view sites/groups Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay … |
Vulnerable |
|
GHSA-g7xc-m762-wg8f
Aliases: CVE-2021-33333 |
Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions The Portal Workflow module in Liferay Portal … |
Vulnerable |
|
GHSA-87x7-pwrx-jch7
Aliases: CVE-2021-29040 |
Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages The JSON web services in Liferay Portal 7.3.4 … |
Vulnerable |
|
GHSA-v88g-7fx4-9q7f
Aliases: CVE-2021-33337 |
Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Document Library module Cross-site scripting (XSS) vulnerability in the … |
Vulnerable |
|
GHSA-mg3r-9jh8-33r9
Aliases: CVE-2020-15842 |
Liferay Portal and Liferay DXP have Insecure Deserialization Vulnerability Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack … |
Vulnerable |
|
GHSA-v377-8f8f-532h
Aliases: CVE-2020-13445 |
Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before … |
Vulnerable |
|
GHSA-hgjv-7wjr-qwqp
Aliases: CVE-2021-33326 |
Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module Cross-site scripting (XSS) vulnerability in the … |
Vulnerable |
|
GHSA-8j5r-9687-88w5
Aliases: CVE-2020-13444 |
Liferay Portal and Liferay DXP Fails to Sanitize API Data Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before … |
Vulnerable |
|
GHSA-9995-qvcg-x7g6
Aliases: CVE-2021-33332 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in … |
Vulnerable |
|
GHSA-wg4x-hf94-fj5v
Aliases: CVE-2021-33320 |
Liferay Portal and Liferay DXP vulnerable to email spam via lack of flagging rate The Flags module before version 5.0.11 … |
Vulnerable |
|
GHSA-wcr5-3q96-c2gr
Aliases: CVE-2021-29044 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-vrwx-q9pj-x488
Aliases: CVE-2020-15840 |
Liferay Portal and Liferay DXP Bypass via Double Encoded URL In Liferay Portal before 7.3.1, com.liferay.portal:com.liferay.portal.impl before 7.1.3 and 7.4.0, … |
Vulnerable |
|
GHSA-w28v-87g6-cjr6
Aliases: CVE-2021-29049 |
Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the currentURL Parameter Cross-site scripting (XSS) vulnerability in the Portal Workflow module's … |
Vulnerable |
|
GHSA-773f-f929-qgjj
Aliases: CVE-2020-15841 |
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection Liferay Portal before 7.3.0, and Liferay DXP … |
Vulnerable |
|
GHSA-6c88-gvxw-f5hg
Aliases: CVE-2021-33325 |
Liferay Portal and Liferay DXP Stores User Passwords in Cleartext The Portal Workflow module in Liferay Portal 7.3.2 and earlier, … |
Vulnerable |
|
GHSA-g37f-j8hh-736f
Aliases: CVE-2021-33334 |
Liferay Portal and Liferay DXP Fails to Properly Check User Permissions The Dynamic Data Mapping module in Liferay Portal 7.0.0 … |
Vulnerable |
|
GHSA-22wc-7wmm-v4cc
Aliases: CVE-2021-33327 |
Liferay Portal and Liferay DXP does not properly check user permission The Portlet Configuration module before 4.0.13 in Liferay Portal … |
Vulnerable |
|
GHSA-mj8w-h522-jwm8
Aliases: CVE-2021-33331 |
Liferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs Open redirect vulnerability in the Notifications module … |
Vulnerable |
|
GHSA-fxpf-jr2q-vpvv
Aliases: CVE-2021-33323 |
Liferay Portal and Liferay DXP autosaves form data for other users to see The Dynamic Data Mapping module in Dynamic … |
Vulnerable |
|
GHSA-vwj8-4grf-3r8v
Aliases: CVE-2021-33322 |
Liferay Portal and Liferay DXP fails to invalidate password reset tokens after use In implementation for the portal services before … |
Vulnerable |
|
GHSA-vpvm-3wfw-5f5c
Aliases: CVE-2021-33328 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page Cross-site scripting (XSS) vulnerability in the … |
Vulnerable |
|
GHSA-vw6g-gh6c-8qwp
Aliases: CVE-2021-38269 |
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in the Gogo Shell module Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-f855-2rvm-5j7h
Aliases: CVE-2021-38268 |
Liferay Portal and Liferay DXP has incorrect default permissions for site members The Dynamic Data Mapping module before 4.0.39 from … |
Vulnerable |
|
GHSA-7m65-hmvg-rxpc
Aliases: CVE-2022-28978 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module Stored cross-site scripting (XSS) vulnerability in the Site … |
Vulnerable |
|
GHSA-xpjg-7hx7-wgcx
Aliases: CVE-2024-25147 |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through … |
Vulnerable |
|
GHSA-qwj8-qgpr-8crm
Aliases: CVE-2024-25148 |
Liferay Portal vulnerable to user impersonation In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 … |
Vulnerable |
|
GHSA-44jg-jgjx-3xg5
Aliases: CVE-2024-25603 |
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability … |
Vulnerable |
|
GHSA-cr36-3vqf-x5w5
Aliases: CVE-2024-25601 |
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Expando module's … |
Vulnerable |
|
GHSA-2mx7-xvfg-fg53
Aliases: CVE-2023-47798 |
Liferay Portal's account lockout does not invalidate existing user sessions Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older … |
Vulnerable |
|
GHSA-mqf8-4cqm-p83x
Aliases: CVE-2024-25146 |
Liferay Portal allows attackers to discover the existence of sites Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and … |
Vulnerable |
|
GHSA-p28x-4r5h-ph6j
Aliases: CVE-2024-25152 |
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Message … |
Vulnerable |
|
GHSA-hgr6-6hhw-883f
Aliases: CVE-2024-25151 |
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing The Calendar module in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-rwxc-4cmw-7x75
Aliases: CVE-2024-26266 |
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-v2xq-m22w-jmpr
Aliases: CVE-2024-25602 |
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Users … |
Vulnerable |
|
GHSA-w275-m8cr-hf2v
Aliases: CVE-2024-25144 |
Liferay Portal denial-of-service vulnerability The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP … |
Vulnerable |
|
GHSA-mh9r-9pcx-rx55
Aliases: CVE-2021-29050 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery in Terms of Use Page Cross-Site Request Forgery (CSRF) vulnerability … |
Vulnerable |
|
GHSA-hv45-r2f5-fmhj
Aliases: CVE-2023-42628 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget Stored cross-site scripting (XSS) vulnerability in the Wiki … | There are no reported fixed by versions. |
|
CVE-2022-28979
Aliases: GHSA-7r3w-wggm-pjwf |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module In Search Web before v6.0.19 in Liferay … | There are no reported fixed by versions. |
|
GHSA-474f-cmx5-gm69
Aliases: CVE-2021-33324 |
Liferay Portal and Liferay DXP Don't Check Permissions of Pages The Layout module in Liferay Portal 7.1.0 through 7.3.1, and … |
Vulnerable Vulnerable |
|
GHSA-7pxh-q6jw-6xj8
Aliases: CVE-2021-33339 |
Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site Scripting Cross-site scripting (XSS) vulnerability in the Fragment module in … |
Vulnerable Vulnerable |
|
GHSA-xx2h-2hf5-v7vv
Aliases: CVE-2021-29043 |
Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password The Portal Store module in Liferay Portal 7.0.0 through … |
Vulnerable Vulnerable |
|
GHSA-5gh9-g62h-f35m
Aliases: CVE-2021-33335 |
Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers Privilege escalation vulnerability in Liferay Portal 7.0.3 through … |
Vulnerable Vulnerable |
|
GHSA-jvvx-8g42-9559
Aliases: CVE-2021-29051 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App Cross-site scripting (XSS) vulnerability in the … |
Vulnerable Vulnerable |
|
GHSA-4frg-rpx6-96qh
Aliases: CVE-2021-33338 |
Liferay Portal Layout Module and Liferay DXP Exposes the Cross-Site Request Forgery (CSRF) Token in URLs The Layout module in … |
Vulnerable Vulnerable |
|
GHSA-7r3w-wggm-pjwf
Aliases: CVE-2022-28979 |
Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module In Search Web before v6.0.19 in Liferay … | There are no reported fixed by versions. |
|
GHSA-rwhv-hvj2-qrqm
Aliases: CVE-2024-26269 |
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in the Frontend … |
Vulnerable Vulnerable |