CVSS: 5.4EPSS: 0%CPEs: 13EXPL: 1CVE-2022-38902
https://notcve.org/view.php?id=CVE-2022-38902
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic. Una vulnerabilidad de tipo Cross-site scripting (XSS) en la funcionalidad Blog module - add new topic en Liferay Digital Experience Platform 7.3.10 SP3, permite a atacantes remotos inyectar scripts JS o HTML arbitrarios en el campo del nombre del tema recién creado • http://liferay.com https://drive.proton.me/urls/D27RQ14NGW#b71d8XrBl2Mu https://www.offensity.com/en/blog/authenticated-persistent-xss-in-liferay-dxp-cms-cve-2022-38901-and-cve-2022-38902 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-41414
https://notcve.org/view.php?id=CVE-2022-41414
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages. Un fallo no seguro en el componente auth.login.prompt.enabled de Liferay Portal versiones v7.0.0 hasta v7.4.2, permite a atacantes enumerar nombres de usuarios, nombres de sitios y páginas • https://portal.liferay.dev/learn/security/known-vulnerabilities • CWE-276: Incorrect Default Permissions •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-28980
https://notcve.org/view.php?id=CVE-2022-28980
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en Liferay Portal versión v7.4.3.4 y Liferay DXP versión v7.4 GA, permiten a atacantes ejecutar scripts web o HTML arbitrarios por medio de parámetros con el prefijo filter_ • http://liferay.com https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28980-reflected-xss-with-filter_%2A-parameters-in-applied-fragment-filters • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 37EXPL: 0CVE-2022-28977
https://notcve.org/view.php?id=CVE-2022-28977
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect. El archivo HtmlUtil.escapeRedirect en Liferay Portal versiones 7.3.1 hasta 7.4.2, y Liferay DXP versiones 7.0 fix pack 91 hasta 101, 7.1 fix pack 17 hasta 25, 7.2 fix pack 5 hasta 14, y 7. 3 anteriores a service pack 3, puede ser omitido mediante el uso de múltiples barras diagonales, lo que permite a atacantes remotos redirigir a usuarios a URLs externas arbitrarias por medio del parámetro (1) "redirect" (2) "FORWARD_URL" y (3) otros parámetros que dependen de HtmlUtil.escapeRedirect • http://liferay.com https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28977-htmlutil.escaperedirect-circumvention-with-multiple-forward-slash • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2022-28982
https://notcve.org/view.php?id=CVE-2022-28982
A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag. Una vulnerabilidad de tipo cross-site scripting (XSS) en Liferay Portal versiones v7.3.3 hasta v7.4.2 y Liferay DXP versiones v7.3 anteriores a service pack 3 permite a atacantes ejecutar scripts web o HTML arbitrarios por medio de una carga útil diseñada inyectada en el nombre de una etiqueta • http://liferay.com https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-28982-reflected-xss-with-tag-name-in-%253Cliferay-asset-asset-tags-selector%253E • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •