Search for packages
| purl | pkg:maven/com.liferay.portal/release.portal.bom@7.0.6-2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 8.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-mg53-xr8m-86hw
Aliases: CVE-2020-24554 |
Open Redirect in Liferay Portal The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs … |
Vulnerable |
|
GHSA-p9gc-59hf-x48p
Aliases: CVE-2025-43748 |
Liferay Portal Vulnerable to Cross-Site Request Forgery Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and … | There are no reported fixed by versions. |
|
GHSA-f43m-hhj4-q3jg
Aliases: CVE-2022-42132 |
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL The Test LDAP Users functionality in Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-9427-7f65-88c8
Aliases: CVE-2022-41414 |
Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 … | There are no reported fixed by versions. |
|
GHSA-g7xc-m762-wg8f
Aliases: CVE-2021-33333 |
Liferay Portal and Liferay DXP Fails to Check User Permissions for Workflow Submissions The Portal Workflow module in Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-87x7-pwrx-jch7
Aliases: CVE-2021-29040 |
Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages The JSON web services in Liferay Portal 7.3.4 … |
Vulnerable |
|
GHSA-jfch-m2x3-2v66
Aliases: CVE-2021-33321 |
Liferay Portal and Liferay DXP insecure default configuration Insecure default configuration in portal services implementation before 5.11.0 in Liferay Portal … |
Vulnerable |
|
GHSA-mg3r-9jh8-33r9
Aliases: CVE-2020-15842 |
Liferay Portal and Liferay DXP have Insecure Deserialization Vulnerability Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack … |
Vulnerable |
|
GHSA-v377-8f8f-532h
Aliases: CVE-2020-13445 |
Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before … |
Vulnerable |
|
GHSA-8j5r-9687-88w5
Aliases: CVE-2020-13444 |
Liferay Portal and Liferay DXP Fails to Sanitize API Data Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before … |
Vulnerable |
|
GHSA-wcr5-3q96-c2gr
Aliases: CVE-2021-29044 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-vrwx-q9pj-x488
Aliases: CVE-2020-15840 |
Liferay Portal and Liferay DXP Bypass via Double Encoded URL In Liferay Portal before 7.3.1, com.liferay.portal:com.liferay.portal.impl before 7.1.3 and 7.4.0, … |
Vulnerable |
|
GHSA-pvpg-9553-f979
Aliases: CVE-2020-25476 |
Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via User Name Parameter Liferay CMS Portal version 7.1.3 and 7.2.1 have a … | There are no reported fixed by versions. |
|
GHSA-372h-p48h-xw8q
Aliases: CVE-2019-16891 |
Liferay Portal Allows RCE via Deserialization of a JSON Payload Liferay Portal CE 7.1.0 and earlier allows remote command execution … |
Vulnerable |
|
GHSA-773f-f929-qgjj
Aliases: CVE-2020-15841 |
Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection Liferay Portal before 7.3.0, and Liferay DXP … |
Vulnerable |
|
GHSA-g37f-j8hh-736f
Aliases: CVE-2021-33334 |
Liferay Portal and Liferay DXP Fails to Properly Check User Permissions The Dynamic Data Mapping module in Liferay Portal 7.0.0 … | There are no reported fixed by versions. |
|
GHSA-mj8w-h522-jwm8
Aliases: CVE-2021-33331 |
Liferay Portal and Liferay DXP Allows Arbitrary Redirect of Users to External URLs Open redirect vulnerability in the Notifications module … | There are no reported fixed by versions. |
|
GHSA-vpvm-3wfw-5f5c
Aliases: CVE-2021-33328 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Edit Vocabulary Page Cross-site scripting (XSS) vulnerability in the … | There are no reported fixed by versions. |
|
GHSA-chj2-4vg7-hhg3
Aliases: CVE-2024-8980 |
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console The Script Console in Liferay Portal 7.0.0 through … | There are no reported fixed by versions. |
|
GHSA-px38-239g-x5mg
Aliases: CVE-2023-37940 |
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-xpjg-7hx7-wgcx
Aliases: CVE-2024-25147 |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through … | There are no reported fixed by versions. |
|
GHSA-43h9-p3j4-39hm
Aliases: CVE-2024-25607 |
Liferay Portal defaults to a low work factor for the default password hashing algorithm The default password hashing algorithm (PBKDF2-HMAC-SHA1) … |
Vulnerable |
|
GHSA-44jg-jgjx-3xg5
Aliases: CVE-2024-25603 |
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability … |
Vulnerable |
|
GHSA-cr36-3vqf-x5w5
Aliases: CVE-2024-25601 |
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Expando module's … | There are no reported fixed by versions. |
|
GHSA-mc8m-4r3w-q2hw
Aliases: CVE-2022-45320 |
Privilege escalation in Liferay Portal Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update … |
Vulnerable |
|
GHSA-29xx-fhff-36m7
Aliases: CVE-2024-26265 |
Liferay Portal vulnerable to Denial of Service The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported … |
Vulnerable |
|
GHSA-p28x-4r5h-ph6j
Aliases: CVE-2024-25152 |
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Message … | There are no reported fixed by versions. |
|
GHSA-hgr6-6hhw-883f
Aliases: CVE-2024-25151 |
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing The Calendar module in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-869h-qhfx-w939
Aliases: CVE-2024-25606 |
Liferay Portal has an XXE vulnerability in Java2WsddTask._format XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, … |
Vulnerable |
|
GHSA-rwxc-4cmw-7x75
Aliases: CVE-2024-26266 |
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-v2xq-m22w-jmpr
Aliases: CVE-2024-25602 |
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Users … | There are no reported fixed by versions. |
|
GHSA-vvpf-53qx-cxhh
Aliases: CVE-2024-25610 |
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported … |
Vulnerable |
|
GHSA-9vgq-w5pv-v77q
Aliases: CVE-2024-25145 |
Liferay Portal stored cross-site scripting (XSS) vulnerability Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app … |
Vulnerable |
|
GHSA-g9mr-9xfc-4gf7
Aliases: CVE-2023-33949 |
Insecure Default Initialization In Liferay Portal In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default … |
Vulnerable |
|
CVE-2024-25151
Aliases: GHSA-hgr6-6hhw-883f |
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing The Calendar module in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-2ggw-8gmc-r2gq
Aliases: CVE-2017-1000425 |
Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in … | There are no reported fixed by versions. |
|
GHSA-hwp2-gvm5-452f
Aliases: CVE-2019-6588 |
Liferay Portal Allows Cross-Site Scripting (XSS) via the SimpleCaptcha API In Liferay Portal before 7.1 CE GA4, an XSS vulnerability … |
Vulnerable Vulnerable |
|
GHSA-xx2h-2hf5-v7vv
Aliases: CVE-2021-29043 |
Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password The Portal Store module in Liferay Portal 7.0.0 through … |
Vulnerable Vulnerable |
|
GHSA-5gh9-g62h-f35m
Aliases: CVE-2021-33335 |
Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers Privilege escalation vulnerability in Liferay Portal 7.0.3 through … |
Vulnerable Vulnerable |