Search for packages
| purl | pkg:maven/com.liferay.portal/release.portal.bom@7.3.5 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-378f-8q54-3fqx
Aliases: CVE-2025-43830 |
Liferay Portal is vulnerable to Stored XSS through Forms text type field Stored cross-site scripting (XSS) vulnerability in Forms in … |
Vulnerable |
|
GHSA-g4wg-mpfg-x2q6
Aliases: CVE-2025-3639 |
Liferay Portal Login Bypass Vulnerability Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 … | There are no reported fixed by versions. |
|
GHSA-p9gc-59hf-x48p
Aliases: CVE-2025-43748 |
Liferay Portal Vulnerable to Cross-Site Request Forgery Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and … | There are no reported fixed by versions. |
|
GHSA-vjj4-qwcm-552h
Aliases: CVE-2022-42124 |
Inefficient Regular Expression Complexity in Liferay Portal ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP … |
Vulnerable |
|
GHSA-g6x4-57hp-j4xm
Aliases: CVE-2022-42129 |
Authorization Bypass in Liferay Portal An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay … |
Vulnerable |
|
GHSA-hffx-r282-w2g9
Aliases: CVE-2022-42123 |
Path Traversal in Liferay Portal A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and … |
Vulnerable |
|
GHSA-f43m-hhj4-q3jg
Aliases: CVE-2022-42132 |
Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL The Test LDAP Users functionality in Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-cx84-43xc-3gm2
Aliases: CVE-2022-42131 |
Improper Certificate Validation in Liferay Portal Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data … |
Vulnerable |
|
GHSA-mxvq-cv4x-p3jw
Aliases: CVE-2022-42130 |
Incorrect Default Permissions in Liferay Portal The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP … |
Vulnerable |
|
GHSA-9427-7f65-88c8
Aliases: CVE-2022-41414 |
Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 … | There are no reported fixed by versions. |
|
GHSA-qcv4-gv43-498v
Aliases: CVE-2021-29045 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via the Redirect's Admin Page Cross-site scripting (XSS) vulnerability in … | There are no reported fixed by versions. |
|
GHSA-pr7v-qv65-rp9m
Aliases: CVE-2021-29052 |
Liferay Portal and Liferay DXP Fails to Check Permissions The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and … | There are no reported fixed by versions. |
|
GHSA-f9wj-c5pc-g9rh
Aliases: CVE-2021-29053 |
Liferay Portal and Liferay DXP Vulnerable to Multiple SQL Injections Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay … |
Vulnerable |
|
GHSA-wcr5-3q96-c2gr
Aliases: CVE-2021-29044 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Membership Request Admin Page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-9mxg-p873-6793
Aliases: CVE-2021-29047 |
Liferay Portal and Liferay DXP Fails to Invalidate CAPTCHA Answers After Use The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 … |
Vulnerable |
|
GHSA-9g57-m5vf-qp73
Aliases: CVE-2021-29046 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) via Asset Module Parameter Cross-site scripting (XSS) vulnerability in the … | There are no reported fixed by versions. |
|
GHSA-r39x-3qq4-gxmr
Aliases: CVE-2021-38267 |
Liferay Portal and Liferay DXP vulnerable to cross-site scripting (XSS) in edit blog entry page Cross-site scripting (XSS) vulnerability in … | There are no reported fixed by versions. |
|
GHSA-83qx-288m-72w4
Aliases: CVE-2022-39975 |
Liferay Portal Missing Authorization vulnerability The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update … |
Vulnerable |
|
GHSA-w397-9p2j-6x23
Aliases: CVE-2022-28977 |
Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 … | There are no reported fixed by versions. |
|
GHSA-3mfq-fp2f-vwqh
Aliases: CVE-2024-38002 |
Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions The workflow component in Liferay Portal 7.3.2 through … |
Vulnerable |
|
GHSA-chj2-4vg7-hhg3
Aliases: CVE-2024-8980 |
Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console The Script Console in Liferay Portal 7.0.0 through … | There are no reported fixed by versions. |
|
GHSA-px38-239g-x5mg
Aliases: CVE-2023-37940 |
Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page Cross-site scripting (XSS) vulnerability in … |
Vulnerable |
|
GHSA-4hxr-28mv-q729
Aliases: CVE-2024-11993 |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, … |
Vulnerable |
|
GHSA-xpjg-7hx7-wgcx
Aliases: CVE-2024-25147 |
Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through … | There are no reported fixed by versions. |
|
GHSA-43h9-p3j4-39hm
Aliases: CVE-2024-25607 |
Liferay Portal defaults to a low work factor for the default password hashing algorithm The default password hashing algorithm (PBKDF2-HMAC-SHA1) … |
Vulnerable |
|
GHSA-qwj8-qgpr-8crm
Aliases: CVE-2024-25148 |
Liferay Portal vulnerable to user impersonation In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 … |
Vulnerable |
|
GHSA-44jg-jgjx-3xg5
Aliases: CVE-2024-25603 |
Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability … |
Vulnerable |
|
GHSA-mf8h-grfg-j9j3
Aliases: CVE-2024-25605 |
Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API The Journal module in Liferay … | There are no reported fixed by versions. |
|
GHSA-cr36-3vqf-x5w5
Aliases: CVE-2024-25601 |
Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Expando module's … | There are no reported fixed by versions. |
|
GHSA-3qq5-wcrx-4h8r
Aliases: CVE-2024-25609 |
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, … | There are no reported fixed by versions. |
|
GHSA-87m3-6qj3-p3xh
Aliases: CVE-2024-25143 |
Liferay Portal denial of service (memory consumption) The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older … |
Vulnerable |
|
GHSA-mc8m-4r3w-q2hw
Aliases: CVE-2022-45320 |
Privilege escalation in Liferay Portal Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update … |
Vulnerable |
|
GHSA-29xx-fhff-36m7
Aliases: CVE-2024-26265 |
Liferay Portal vulnerable to Denial of Service The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported … |
Vulnerable |
|
GHSA-mqf8-4cqm-p83x
Aliases: CVE-2024-25146 |
Liferay Portal allows attackers to discover the existence of sites Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and … |
Vulnerable |
|
GHSA-p28x-4r5h-ph6j
Aliases: CVE-2024-25152 |
Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Message … | There are no reported fixed by versions. |
|
GHSA-hgr6-6hhw-883f
Aliases: CVE-2024-25151 |
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing The Calendar module in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-2mvj-q2q3-wxjv
Aliases: CVE-2024-26267 |
Liferay Portal and Liferay DXP HTTP Header Can Expose Versions In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, … | There are no reported fixed by versions. |
|
GHSA-4585-28v2-8h46
Aliases: CVE-2024-25150 |
Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel Information disclosure vulnerability in the Control Panel in … | There are no reported fixed by versions. |
|
GHSA-869h-qhfx-w939
Aliases: CVE-2024-25606 |
Liferay Portal has an XXE vulnerability in Java2WsddTask._format XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, … |
Vulnerable |
|
GHSA-rwxc-4cmw-7x75
Aliases: CVE-2024-26266 |
Liferay Portal and Liferay DXP vulnerable to stored Cross-site Scripting Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-v2xq-m22w-jmpr
Aliases: CVE-2024-25602 |
Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting Stored cross-site scripting (XSS) vulnerability in Users … | There are no reported fixed by versions. |
|
GHSA-pw7p-3648-qqmg
Aliases: CVE-2024-25604 |
Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions Liferay Portal 7.2.0 through 7.4.3.4, and … | There are no reported fixed by versions. |
|
GHSA-548x-j6x6-hcv4
Aliases: CVE-2024-25608 |
Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and … | There are no reported fixed by versions. |
|
GHSA-qm43-g2xj-hvg5
Aliases: CVE-2024-26268 |
Liferay Portal and Liferay DXP User Enumeration Vulnerability User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported … | There are no reported fixed by versions. |
|
GHSA-w275-m8cr-hf2v
Aliases: CVE-2024-25144 |
Liferay Portal denial-of-service vulnerability The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP … |
Vulnerable |
|
GHSA-qpgh-6v9w-vfv6
Aliases: CVE-2024-25149 |
Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options Liferay Portal … | There are no reported fixed by versions. |
|
GHSA-vvpf-53qx-cxhh
Aliases: CVE-2024-25610 |
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported … |
Vulnerable |
|
GHSA-9vgq-w5pv-v77q
Aliases: CVE-2024-25145 |
Liferay Portal stored cross-site scripting (XSS) vulnerability Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app … |
Vulnerable |
|
GHSA-g7vw-43xg-8m4h
Aliases: CVE-2023-33945 |
SQL injection in Liferay Portal SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through … |
Vulnerable |
|
GHSA-wvhw-5m89-64gv
Aliases: CVE-2023-33938 |
Cross-site scripting in Liferay Portal Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay … |
Vulnerable |
|
GHSA-53mw-69qx-q4fc
Aliases: CVE-2023-33939 |
Cross-site scripting in Liferay Portal Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, … |
Vulnerable |
|
GHSA-pfwc-4frf-4gf8
Aliases: CVE-2023-33944 |
Cross-site scripting in Liferay Portal Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay … |
Vulnerable |
|
CVE-2024-25151
Aliases: GHSA-hgr6-6hhw-883f |
Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing The Calendar module in Liferay Portal 7.2.0 … |
Vulnerable |
|
GHSA-qhp6-vp7c-g7xp
Aliases: CVE-2025-3760 |
Liferay Cross-site Scripting vulnerability A stored cross-site scripting (XSS) vulnerability exists with radio button type custom fields in Liferay Portal … |
Vulnerable Vulnerable |
|
GHSA-642h-mx8q-47p2
Aliases: CVE-2022-42126 |
Missing permissions check in Liferay Portal The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 … |
Vulnerable Vulnerable |
|
GHSA-xx2h-2hf5-v7vv
Aliases: CVE-2021-29043 |
Liferay Portal and Liferay DXP May Reveal S3 Store's Proxy Password The Portal Store module in Liferay Portal 7.0.0 through … |
Vulnerable Vulnerable |
|
GHSA-4fx8-82f3-xcpc
Aliases: CVE-2021-29048 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in the Layout Admin Page Cross-site scripting (XSS) vulnerability in … |
Vulnerable Vulnerable |
|
GHSA-jvvx-8g42-9559
Aliases: CVE-2021-29051 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS) in Asset Publisher App Cross-site scripting (XSS) vulnerability in the … |
Vulnerable Vulnerable |
|
GHSA-p63m-vmjr-wg37
Aliases: CVE-2024-26272 |
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor Cross-site request forgery (CSRF) … | There are no reported fixed by versions. |
|
GHSA-54pv-r62j-9qqc
Aliases: CVE-2023-42496 |
Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting Reflected cross-site scripting (XSS) vulnerability on the add assignees to … |
Vulnerable Vulnerable |
|
GHSA-rwhv-hvj2-qrqm
Aliases: CVE-2024-26269 |
Liferay Portal Frontend JS module's portlet.js and Liferay DXP vulnerable to Cross-site Scripting Cross-site scripting (XSS) vulnerability in the Frontend … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-87x7-pwrx-jch7
|
Liferay Portal and Liferay DXP Reveals Data via Overly Verbose Error Messages The JSON web services in Liferay Portal 7.3.4 … |
CVE-2021-29040
|
|
GHSA-239w-4f3w-cfcv
|
Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page Cross-site scripting (XSS) vulnerability in the Asset module's categories … |
CVE-2021-29039
|
|
CVE-2021-29039
|
Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via Categories Admin Page Cross-site scripting (XSS) vulnerability in the Asset module's categories … |
GHSA-239w-4f3w-cfcv
|
|
GHSA-7pxh-q6jw-6xj8
|
Liferay Portal Fragment Module and Liferay DXP Vulnerable to Cross-Site Scripting Cross-site scripting (XSS) vulnerability in the Fragment module in … |
CVE-2021-33339
|
|
GHSA-5gh9-g62h-f35m
|
Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers Privilege escalation vulnerability in Liferay Portal 7.0.3 through … |
CVE-2021-33335
|