CVSS: 4.3EPSS: 0%CPEs: 89EXPL: 0CVE-2021-33334
https://notcve.org/view.php?id=CVE-2021-33334
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with the forms "Access in Site Administration" permission to view all forms and form entries in a site via the forms section in site administration. El módulo Dynamic Data Mapping en Liferay Portal versiones 7.0.0 hasta 7.3.2, y Liferay DXP versiones 7.0 anteriores a fix pack 94, versiones 7.1 anteriores a fix pack 19, y versiones 7.2 anteriores a fix pack 6, no comprueba apropiadamente los permisos de usuario, que permite a atacantes remotos con permiso de formularios "Access in Site Administration" visualizar todos los formularios y entradas de formularios en un sitio por medio de la sección de formularios en la administración del sitio • https://issues.liferay.com/browse/LPE-17039 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120748332 • CWE-276: Incorrect Default Permissions •
CVSS: 6.5EPSS: 0%CPEs: 88EXPL: 0CVE-2021-33333
https://notcve.org/view.php?id=CVE-2021-33333
The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to view and delete workflow submissions via crafted URLs. El módulo Portal Workflow en Liferay Portal versiones 7.3.2 y anteriores, y Liferay DXP versiones 7.0 anteriores a fix pack 93, versiones 7.1 anteriores a fix pack 19 y versiones 7.2 anteriores a fix pack 6, no comprueba apropiadamente los permisos de usuario, que permite a usuarios autenticados remotos visualizar y eliminar envíos de flujos de trabajo por medio de URLs diseñadas • https://issues.liferay.com/browse/LPE-17032 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747742 • CWE-276: Incorrect Default Permissions •
CVSS: 6.1EPSS: 0%CPEs: 91EXPL: 0CVE-2021-33331
https://notcve.org/view.php?id=CVE-2021-33331
Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19 and 7.2 before fix pack 8, allows remote attackers to redirect users to arbitrary external URLs via the 'redirect' parameter. Una vulnerabilidad de redireccionamiento abierto en el módulo Notifications de Liferay Portal versiones 7.0.0 hasta 7.3.1, y Liferay DXP versiones 7.0 anteriores a fix pack 94, versiones 7.1 anteriores a fix pack 19 y versiones 7.2 anteriores a fix pack 8, permite a atacantes remotos redirigir a usuarios a URLs externas arbitrario por medio del parámetro "redirect" • https://issues.liferay.com/browse/LPE-17022 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747627 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 95EXPL: 0CVE-2021-33328
https://notcve.org/view.php?id=CVE-2021-33328
Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the (1) _com_liferay_journal_web_portlet_JournalPortlet_name or (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name parameter. Una vulnerabilidad de tipo Cross-site scripting (XSS) en la página de edición de vocabulario del módulo Asset en Liferay Portal versiones 7.0.0 hasta 7.3.4, y Liferay DXP versiones 7.0 anteriores a fix pack 96, versiones 7.1 anteriores a fix pack 20, y versiones 7. 2 anteriores a fix pack 9, permite a atacantes remotos inyectar script web o HTML arbitrario por medio de los parámetros (1) _com_liferay_journal_web_portlet_JournalPortlet_name o (2) _com_liferay_document_library_web_portlet_DLAdminPortlet_name • https://issues.liferay.com/browse/LPE-17100 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747972 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 95EXPL: 0CVE-2021-33326
https://notcve.org/view.php?id=CVE-2021-33326
Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window. Una vulnerabilidad de tipo Cross-site scripting (XSS) en el módulo Frontend JS de Liferay Portal versiones 7.3.4 y anteriores, y Liferay DXP versiones 7.0 anterior a fix pack 96, versiones 7.1 anterior a fix pack 20 y versiones 7.2 anterior a fix pack 9, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del título de una ventana modal • https://issues.liferay.com/browse/LPE-17093 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747869 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •