Liferay

Records340All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical29CVSS 9.0–10.0

CVSS high43CVSS 7.0–8.9

Exploited now

Liferay records in CISA KEV

TI-2020-06440 Liferay Portal Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Liferay Portal 319 records CRITICAL Digital Experience Platform 264 records MEDIUM Dxp 39 records MEDIUM Liferay Enterprise Portal 9 records LOW Portal 2 records LOW Liferay 1 record MEDIUM Liferay Portal Enterprise 1 record LOW

Records

9 records in Liferay Enterprise Portal · all components

TI-2009-01229 CVE-2009-1294 · GHSA-94fp-6r45-7325

Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay…

LOW 28

Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home in the Liferay 4.3.0 portal in Novell Teaming 1.0 through SP3 (1.0.3) allow remote attackers to inject arbitrary web script or HTML via the (1) p_p_st…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04696 Published 2009-04-16 No fix listed CWE-79

TI-2008-00163 CVE-2008-0178 · GHSA-vcpx-p674-q774

Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring…

LOW 24

Cross-site scripting (XSS) vulnerability in the Enterprise Admin Session Monitoring component in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the User-Agent HTTP heade…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0201 Published 2008-02-04 No fix listed CWE-79

TI-2007-05888 CVE-2007-6173 · GHSA-7wh2-f5fv-2c6f

Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal…

LOW 24

Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Enterprise Portal 4.3.1 allows remote attackers to inject arbitrary web script or HTML via the emailAddress parameter in a Send New Password action, a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02307 Published 2007-11-30 No fix listed CWE-79

TI-2004-01903 CVE-2004-2030 · GHSA-xh4h-8w7q-32rw

Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004 allow remote attackers to inject arbitrary web script or HTML, as demonstrated using the message subject.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0208 Published 2005-05-10 No fix listed CWE-79

TI-2008-00166 CVE-2008-0181 · GHSA-x44x-w9hc-7q9v

Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6…

LOW 23

Cross-site scripting (XSS) vulnerability in the Admin portlet in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Shutdown message.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01338 Published 2008-02-04 No fix listed CWE-79

TI-2008-00165 CVE-2008-0180 · GHSA-w6gr-v7vh-5878

Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay…

LOW 23

Cross-site scripting (XSS) vulnerability in themes/_unstyled/templates/init.vm in Liferay Portal 4.3.6 allows remote authenticated users to inject arbitrary web script or HTML via the Greeting field in a User Profile.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01338 Published 2008-02-04 No fix listed CWE-79

TI-2008-00167 CVE-2008-0182 · GHSA-fxrw-q665-w573

Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal…

LOW 21

Cross-site request forgery (CSRF) vulnerability in the Admin portlet in Liferay Portal before 4.4.0 allows remote authenticated users to perform unspecified actions as unspecified other authenticated users via the Shutdo…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00602 Published 2008-02-04 No fix listed CWE-352

TI-2008-00535 CVE-2008-0563 · GHSA-pc3p-r5pr-cv9v

Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java…

LOW 20

Cross-site request forgery (CSRF) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to perform unspecified actions as unspecified authenticated users via the User-Age…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00438 Published 2008-02-04 No fix listed CWE-352

TI-2008-00164 CVE-2008-0179 · GHSA-rwq6-722f-xx8m

Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in…

LOW 16

Cross-site scripting (XSS) vulnerability in service/impl/UserLocalServiceImpl.java in Liferay Portal 4.3.6 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, which is used when…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01212 Published 2008-02-04 No fix listed CWE-79

Open these records in search →

Critical	29
High	43
Medium	254
Low	14
No CVSS	0