WaratekVRT Sign in

Medium Com.liferay CVEs

115 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
Vendor com.liferay✕
Overview 115 matches · 1 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
115matches 1protected0.9% 0exploited0.0% 0CISA KEV0.0% 4public PoC3.5% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 0.9% Rule in development 0 0.0% Mitigation candidate 4 3.5% No exploit published 110 95.7%
Critical 0 0.0% High 0 0.0% Medium 115 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 0.9% partly blocked 0 0.0% not blocked 114 99.1% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 3.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 111 96.5%
split by peak 74 / year
No exploit published: 110Mitigation candidate: 4Protected by Waratek: 1 Medium: 115 not blocked: 114blocked by ARMR today: 1 No public exploit: 111Working exploit published: 4
20161 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20172 No exploit published2 Medium2 not blocked2 No public exploit2 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20191 No exploit published1 Medium1 not blocked1 No public exploit1 20200 20216 Protected by Waratek1 No exploit published5 Medium6 blocked by ARMR today1 not blocked5 No public exploit6 202227 Mitigation candidate1 No exploit published26 Medium27 not blocked27 Working exploit published1 No public exploit26 20231 No exploit published1 Medium1 not blocked1 No public exploit1 20242 No exploit published2 Medium2 not blocked2 No public exploit2 202574 Mitigation candidate2 No exploit published72 Medium74 not blocked74 Working exploit published2 No public exploit72
2016201720182019202020212022202320242025
115 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2021-38265 Medium 2022-03-03 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Asset module in Liferay Portal 7.3.4 through 7.3.6 allow remote attackers to inject arbitrary web script or HTML when creating a collection page via the _com_liferay_asset_list_web_portlet_AssetListPortlet_title parameter.
CVE-2021-38264 Medium 2022-03-03 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter. This issue is caused by an incomplete fix in CVE-2021-35463.
CVE-2021-38263 Medium 2022-03-03 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Server module's script console in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 20 and 7.2 before fix pack 10 allows remote attackers to inject arbitrary web script or HTML via the output of a script.
CVE-2021-38268 Medium 2022-03-02 No exploit published No public exploit The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
CVE-2021-35463 Medium 2021-08-04 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the `keywords` parameter.
CVE-2021-33337 Medium 2021-08-04 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter.
CVE-2021-33327 Medium 2021-08-03 No exploit published No public exploit The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated users to view the Guest and User role even if "Role Visibility" is enabled.
CVE-2021-33326 Medium 2021-08-03 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window.
CVE-2021-33320 Medium 2021-08-03 No exploit published No public exploit The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 5, does not limit the rate at which content can be flagged as inappropriate, which allows remote authenticated users to spam the site administrator with emails
CVE-2021-29425 Medium 2021-04-13 Protected by Waratek No public exploit In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
CVE-2019-16147 Medium 2019-09-09 No exploit published No public exploit Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.
CVE-2018-1324 Medium 2018-03-16 No exploit published No public exploit A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
CVE-2017-12648 Medium 2017-08-07 No exploit published No public exploit XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
CVE-2017-12646 Medium 2017-08-07 No exploit published No public exploit XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
CVE-2016-3670 Medium 2016-06-13 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
‹ prev page 2 of 2 next ›