CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2023-33940
https://notcve.org/view.php?id=CVE-2023-33940
Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33940 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2022-42126
https://notcve.org/view.php?id=CVE-2022-42126
The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check permissions of asset libraries, which allows remote authenticated users to view asset libraries via the UI. El módulo Asset Libraries en Liferay Portal 7.3.5 a 7.4.3.28, y Liferay DXP 7.3 antes de la actualización 8, y DXP 7.4 antes de la actualización 29 no verifica correctamente los permisos de las librerías de activos, lo que permite a los usuarios remotos autenticados ver las librerías de activos a través de la interfaz de usuario. • http://liferay.com https://issues.liferay.com/browse/LPE-17593 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42126 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-42125
https://notcve.org/view.php?id=CVE-2022-42125
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module. Vulnerabilidad de deslizamiento de zip en FileUtil.unzip en Liferay Portal 7.4.3.5 hasta 7.4.3.35 y Liferay DXP 7.4 actualización 1 hasta la actualización 34 permite a los atacantes crear o sobrescribir archivos existentes en el sistema de archivos mediante la implementación de un complemento/módulo malicioso. • http://liferay.com https://issues.liferay.com/browse/LPE-17517 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42125 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-42127
https://notcve.org/view.php?id=CVE-2022-42127
The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page. El módulo URL Amigables en Liferay Portal v7.4.3.5 a 7.4.3.36 y Liferay DXP 7.4 actualizaciones 1 a 36 no verifica adecuadamente los permisos de usuario, lo que permite a atacantes remotos obtener el historial de todas las URL amigables que se asignaron a una página. • http://liferay.com https://issues.liferay.com/browse/LPE-17607 https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-42127 • CWE-276: Incorrect Default Permissions •
CVSS: 5.4EPSS: 0%CPEs: 36EXPL: 1CVE-2022-38901
https://notcve.org/view.php?id=CVE-2022-38901
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file. Una vulnerabilidad de tipo Cross-site scripting (XSS) en el módulo Document and Media - funcionalidad de descarga de archivos en Liferay Digital Experience Platform versión 7.3.10 SP3, permite a atacantes remotos inyectar scripts JS o HTML arbitrarias en el campo description del archivo svg descargado • http://liferay.com https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •