Page 22 of 107 results (0.005 seconds)

CVSS: 9.8EPSS: 1%CPEs: 75EXPL: 3

CVE-2019-16891

https://notcve.org/view.php?id=CVE-2019-16891

Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload. Liferay Portal CE versión 6.2.5, permite la ejecución de comandos remota debido a la deserialización de una carga útil JSON. • https://dappsec.substack.com/p/an-advisory-for-cve-2019-16891-from https://sec.vnpt.vn/2019/09/liferay-deserialization-json-deserialization-part-4 https://www.liferay.com/downloads-community https://www.youtube.com/watch?v=DjMEfQW3bf0 • CWE-502: Deserialization of Untrusted Data •

CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0

CVE-2019-16147

https://notcve.org/view.php?id=CVE-2019-16147

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib. Liferay Portal versiones hasta 7.2.0 GA1, permite un ataque de tipo XSS por medio de un título de artículo de revista en el archivo journal_article/page.jsp en journal/journal-taglib. • https://github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •