CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-8980
https://notcve.org/view.php?id=CVE-2024-8980
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2024-8980 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25151
https://notcve.org/view.php?id=CVE-2024-25151
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client. El módulo Calendario en Liferay Portal 7.2.0 a 7.4.2 y versiones anteriores no compatibles, y Liferay DXP 7.3 anteriores al service pack 3, 7.2 anteriores al fix pack 15 y versiones anteriores no compatibles no escapa a los datos proporcionados por el usuario en la plantilla de correo electrónico de notificación predeterminada , que permite a los usuarios autenticados remotamente inyectar script web o HTML arbitrarios a través del título de un evento del calendario o el nombre del usuario. Esto puede dar lugar a ataques de suplantación de contenido o de Cross-site scripting (XSS), dependiendo de la capacidad del cliente de correo del receptor. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25151 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26269
https://notcve.org/view.php?id=CVE-2024-26269
Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL. Vulnerabilidad de Cross-site scripting (XSS) en el portlet.js del módulo Frontend JS en Liferay Portal 7.2.0 hasta 7.4.3.37 y Liferay DXP 7.4 antes de la actualización 38, 7.3 antes de la actualización 11, 7.2 antes del fixpack 20 y versiones anteriores no compatibles permite a atacantes remotos inyectar script web o HTML arbitrario a través de la parte de anclaje (hash) de una URL. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26266
https://notcve.org/view.php?id=CVE-2024-26266
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget. Múltiples vulnerabilidades de Cross-site scripting (XSS) almacenadas en Liferay Portal 7.2.0 a 7.4.3.13 y versiones anteriores no compatibles, y Liferay DXP 7.4 antes de la actualización 10, 7.3 antes de la actualización 4, 7.2 antes del fixpack 17 y versiones anteriores no compatibles permiten usuarios autenticados remotamente para inyectar script web o HTML arbitrario a través de un payload manipulado inyectado en el campo de texto del nombre/segundo nombre/apellido del usuario que crea una entrada en el (1) widget de anuncio o (2) widget de alertas. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26266 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-25603
https://notcve.org/view.php?id=CVE-2024-25603
Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter. Vulnerabilidad de Cross-site scripting (XSS) almacenadas en el DDMForm del módulo Dynamic Data Mapping en Liferay Portal 7.2.0 a 7.4.3.4 y versiones anteriores no compatibles, y Liferay DXP 7.4.13, 7.3 antes de la actualización 4, 7.2 antes del fixpack 17, y las versiones anteriores no compatibles permiten a los usuarios autenticados remotamente inyectar script web o HTML arbitrario a través del parámetrostanceId. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25603 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •