CVSS: 9.6EPSS: 0%CPEs: 23EXPL: 1CVE-2023-42627
https://notcve.org/view.php?id=CVE-2023-42627
Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP 7.3 update 33 and earlier, and 7.4 before update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a (1) Shipping Name, (2) Shipping Phone Number, (3) Shipping Address, (4) Shipping Address 2, (5) Shipping Address 3, (6) Shipping Zip, (7) Shipping City, (8) Shipping Region (9), Shipping Country, (10) Billing Name, (11) Billing Phone Number, (12) Billing Address, (13) Billing Address 2, (14) Billing Address 3, (15) Billing Zip, (16) Billing City, (17) Billing Region, (18) Billing Country, or (19) Region Code. Múltiples vulnerabilidades de Cross-Site Scripting (XSS) almacenados en el módulo Commerce en Liferay Portal 7.3.5 hasta 7.4.3.91, y Liferay DXP 7.3 actualización 33 y anteriores, y 7.4 antes de la actualización 92 permiten a atacantes remotos inyectar scripts web o HTML arbitrarios mediante un payload manipulado inyectado en (1) Nombre de Envío, (2) Número de Teléfono de Envío, (3) Dirección de Envío, (4) Dirección de Envío 2, (5) Dirección de Envío 3, (6) Código Postal de Envío, (7) Ciudad de Envío , (8) Región de Envío (9), País de Envío, (10) Nombre de Facturación, (11) Número de Teléfono de Facturación, (12) Dirección de Facturación, (13) Dirección de Facturación 2, (14) Dirección de Facturación 3, (15) Facturación Código Postal, (16) Ciudad de Facturación, (17) Región de Facturación, (18) País de Facturación o (19) Código de Región. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42627 https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 104EXPL: 1CVE-2023-42628
https://notcve.org/view.php?id=CVE-2023-42628
Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML into a parent wiki page via a crafted payload injected into a wiki page's ‘Content’ text field. Vulnerabilidad de Cross-Site Scripting (XSS) almacenadas en el widget Wiki en Liferay Portal 7.1.0 a 7.4.3.87 y Liferay DXP 7.0 fixpack 83 a 102, 7.1 fixpack 28 y anteriores, 7.2 fixpack 20 y anteriores, actualización 7.3 33 y anteriores, y 7.4 anterior a la actualización 88 permite a atacantes remotos inyectar scripts web o HTML arbitrarios en una página wiki principal a través de un payload manipulado inyectado en el campo de texto 'Content' de una página wiki. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-42628 https://www.pentagrid.ch/en/blog/stored-cross-site-scripting-vulnerabilities-in-liferay-portal • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 36EXPL: 0CVE-2023-44310
https://notcve.org/view.php?id=CVE-2023-44310
Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field. Vulnerabilidad de Cross-Site Scripting (XSS) almacenada en Page Tree menu Liferay Portal 7.3.6 hasta 7.4.3.78, y Liferay DXP 7.3 fixpack 1 hasta la actualización 23, y 7.4 antes de la actualización 79 permite a atacantes remotos inyectar script web o HTML arbitrario mediante un payload manipulado inyectado en el campo de texto "Name" de la página. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-44310 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 6EXPL: 0CVE-2023-33945
https://notcve.org/view.php?id=CVE-2023-33945
SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33945 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 0CVE-2023-33944
https://notcve.org/view.php?id=CVE-2023-33944
Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field. • https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2023-33944 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •