CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47795
https://notcve.org/view.php?id=CVE-2023-47795
21 Feb 2024 — Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 18 through 92 allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a document's “Title” text field. Vulnerabilidad de Cross-Site Scripting (XSS) Almacenado en el widget Documentos y Medios en Liferay Portal 7.4.3.18 a 7.4.3.101, y Liferay DXP 2023.Q3 antes del parche 6, y 7... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-47795 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40191
https://notcve.org/view.php?id=CVE-2023-40191
21 Feb 2024 — Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the “Blocked Email Domains” text field Vulnerabilidad de Cross-site scripting (XSS) reflejado en la configuración de instancia para cuentas en Liferay Portal 7.4.3.44 a 7.4.3.97, y Liferay DXP 2023.Q3 antes del... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-40191 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42498
https://notcve.org/view.php?id=CVE-2023-42498
21 Feb 2024 — Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_key parameter. Vulnerabilidad de cross-site scripting (XSS) reflejado en la pantalla de edición de Language Override en Liferay Portal 7.4.3.8 a 7.4.3.97, y Liferay DXP 20... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42498 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26269
https://notcve.org/view.php?id=CVE-2024-26269
21 Feb 2024 — Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL. Vulnerabilidad de Cross-site scripting (XSS) en el portlet.js del módulo Frontend JS en Liferay Portal 7.2.0 hasta 7.4.3.37 y Liferay DXP 7.4 antes de la actualización 38, 7.3... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26269 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42496
https://notcve.org/view.php?id=CVE-2023-42496
21 Feb 2024 — Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_roles_admin_web_portlet_RolesAdminPortlet_tabs2 parameter. Vulnerabilidad de Cross-site scripting (XSS) reflejado al agregar asignados a una página de rol en Liferay Portal 7.3.3 hasta 7.4.3.97 y Liferay DXP ... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26270
https://notcve.org/view.php?id=CVE-2024-26270
20 Feb 2024 — The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password. La página Configuración de Cuenta en Liferay Portal 7.4.3.76 a 7.4.3.99, y Liferay DXP 2023.Q3 antes del parche 5, y 7.4 actualización 76 a 92 incorpora la contraseña hash del usuario en el código fuente HTML de la página, lo que permi... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26270 • CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26268
https://notcve.org/view.php?id=CVE-2024-26268
20 Feb 2024 — User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before update 8, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to determine if an account exist in the application by comparing the request's response time. Vulnerabilidad de enumeración de usuarios en Liferay Portal 7.2.0 a 7.4.3.26 y versiones anteriores no soportadas, y Liferay DXP 7.4 antes de la actualización 27, 7.3 antes de... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26268 • CWE-203: Observable Discrepancy •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26267
https://notcve.org/view.php?id=CVE-2024-26267
20 Feb 2024 — In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 before fix pack 19, and older unsupported versions the default value of the portal property `http.header.version.verbosity` is set to `full`, which allows remote attackers to easily identify the version of the application that is running and the vulnerabilities that affect that version via 'Liferay-Portal` response header. En Liferay Portal 7.2.0 a 7.4.3.25 y versiones ant... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-26267 • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25608
https://notcve.org/view.php?id=CVE-2024-25608
20 Feb 2024 — HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedir... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2024-25608 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5190
https://notcve.org/view.php?id=CVE-2023-5190
20 Feb 2024 — Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 45 through 92 allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_address_web_internal_portlet_CountriesManagementAdminPortlet_redirect parameter. Vulnerabilidad de redireccionamiento abierto en la página de edición de región de Gestión de Países en Liferay Portal 7.4.3.45 a 7.4.3.101, y Liferay D... • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-5190 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •