CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29052
https://notcve.org/view.php?id=CVE-2021-29052
17 May 2021 — The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view DDMStructures via GET API calls. El módulo Data Engine en Liferay Portal versiones 7.3.0 hasta 7.3.5 y Liferay DXP versiones 7.3 anteriores a fixpack 1 no comprueba los permisos en DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefi... • http://liferay.com • CWE-276: Incorrect Default Permissions •
CVSS: 6.1EPSS: 0%CPEs: 33EXPL: 0CVE-2021-29051
https://notcve.org/view.php?id=CVE-2021-29051
17 May 2021 — Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter. Una vulnerabilidad de tipo cross-site scripting (XSS) en la aplicación Asset Publisher del módulo Asset en Liferay Portal... • http://liferay.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 98EXPL: 0CVE-2021-29044
https://notcve.org/view.php?id=CVE-2021-29044
17 May 2021 — Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the _com_liferay_site_my_sites_web_portlet_MySitesPortlet_comments parameter. Una vulnerabilidad de tipo cross-site scripting (XSS) en las páginas de administración de peticiones de membresía... • http://liferay.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 98EXPL: 0CVE-2021-29043
https://notcve.org/view.php?id=CVE-2021-29043
17 May 2021 — The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing. El módulo Portal Store en Liferay Portal versiones 7.0.0 hasta 7.3.5 y Liferay DXP versiones 7.0 anteriores al fixpack 97, versiones 7.1 anteriores al fixpack 21, versiones 7.2 anterio... • http://liferay.com • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.3EPSS: 0%CPEs: 98EXPL: 0CVE-2021-29040
https://notcve.org/view.php?id=CVE-2021-29040
16 May 2021 — The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs. Los servicios web JSON en Liferay Portal versiones 7.3.4 y anteriores, y Liferay DXP versiones 7.0 anteriores al fixpack 97, versiones 7.1 anteriores al fixpack 20 y versiones 7.2 anterio... • http://liferay.com • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25476
https://notcve.org/view.php?id=CVE-2020-25476
07 Jan 2021 — Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload. Liferay CMS Portal versiones 7.1.3 y ... • https://github.com/community-security-team/liferay-portal/compare/7.1.3-ga4...7.1.3-cumulative.patch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2020-15840
https://notcve.org/view.php?id=CVE-2020-15840
24 Sep 2020 — In Liferay Portal before 7.3.1, Liferay Portal 6.2 EE, and Liferay DXP 7.2, DXP 7.1 and DXP 7.0, the property 'portlet.resource.id.banned.paths.regexp' can be bypassed with doubled encoded URLs. En Liferay Portal versiones anteriores a 7.3.1, Liferay Portal versión 6.2 EE y Liferay DXP versión 7.2, DXP ??versión 7.1 y DXP versión 7.0, la propiedad "portlet.resource.id.banned.paths.regexp" puede ser omitida con unas URL codificadas duplicadas. • https://issues.liferay.com/browse/LPE-17046 •
CVSS: 6.5EPSS: 1%CPEs: 26EXPL: 0CVE-2020-15839
https://notcve.org/view.php?id=CVE-2020-15839
22 Sep 2020 — Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files. Liferay Portal versiones anteriores a 7.3.3, y Liferay DXP versiones 7.1 anteriores a fixpack 18 y versiones 7.2 anteriores a fixpack 6, no reucir ataques de denegación de servicio mediante la carga de archivos grandes • https://issues.liferay.com/browse/LPE-17029 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24554
https://notcve.org/view.php?id=CVE-2020-24554
01 Sep 2020 — The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by making repeated requests for pages that do not exist. El módulo de redireccionamiento en Liferay Portal versiones anteriores a 7.3.3 no limita el numero de URLs resultando en un error 404 que es registrado, permitiendo a atacantes remotos llevar a cabo un ataque de denegación de servicio al realizar peticiones r... • https://portal.liferay.dev/learn/security/known-vulnerabilities • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.1EPSS: 0%CPEs: 75EXPL: 0CVE-2020-15842
https://notcve.org/view.php?id=CVE-2020-15842
20 Jul 2020 — Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization. Liferay Portal versiones anteriores a 7.3.0, y Liferay DXP versión 7.0 anterior al papuete 90, versión 7.1 anterior al paquete de corrección 17, y versión 7.2 anterior al paquete de corrección 5, permite a los atacantes man-in-the-middle ejecutar código arbitra... • https://issues.liferay.com/browse/LPE-16963 • CWE-502: Deserialization of Untrusted Data •