Liferay Portal
Approved changes feed: RSS · Atom
cpe:2.3:a:liferay:liferay_portal:*:*:*:*:community:*:*:*
part: a version: * update: *
| Vendor | Liferay (5231553d-d54f-5cd9-bf56-0bf2ac7f0033) |
|---|---|
| Product | Liferay Portal (e3d198b8-0678-58dd-bf73-106b66a02cfe) |
| Edition | * |
| Language | * |
| Software edition | community |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/liferay/portal |
purl2cpe | 2026-06-01 10:15:56.432414 |
pkg:github/liferay/liferay-portal |
purl2cpe | 2026-06-01 10:15:56.432416 |
pkg:liferay/liferay-portal |
purl2cpe | 2026-06-01 10:15:56.432418 |
pkg:sourceforge/lportal |
purl2cpe | 2026-06-01 10:15:56.432419 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-38268 |
vulnerable | 2026-06-08 05:32:55.815791 |
Details available
The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.6, and Liferay DXP 7.0 before fix pack 101, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 2 incorrectly sets default permissions for site members, which allows remote authenticated users with the site member role to add and duplicate forms, via the UI or the API.
Published: 2022-03-02T18:45:26.000Z
Updated: 2026-07-09T00:14:40.384Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38266 |
vulnerable | 2026-06-08 05:32:55.796958 |
Details available
The Portal Security module in Liferay Portal 7.2.1 and earlier, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17 and 7.2 before fix pack 5 does not correctly import users from LDAP, which allows remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exist in LDAP.
Published: 2022-03-02T23:00:44.000Z
Updated: 2026-07-09T00:14:37.927Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-7961 |
vulnerable | 2026-06-08 05:27:14.569612 |
Details available
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Published: 2020-03-20T18:16:42.000Z
Updated: 2025-10-21T23:35:47.558Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-7934 |
vulnerable | 2026-06-08 05:27:14.524344 |
Details available
In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.
Published: 2020-01-28T13:03:44.000Z
Updated: 2024-08-04T09:48:24.506Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-6588 |
vulnerable | 2026-06-08 05:14:12.387747 |
Details available
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
Published: 2019-06-03T19:43:42.000Z
Updated: 2024-08-04T20:23:22.090Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-16891 |
vulnerable | 2026-06-08 05:13:09.500077 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-1000425 |
vulnerable | 2026-06-08 05:08:34.535192 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-1571 |
vulnerable | 2026-06-08 04:58:00.460913 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-1570 |
vulnerable | 2026-06-08 04:58:00.460499 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-1503 |
vulnerable | 2026-06-08 04:57:59.838924 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-1502 |
vulnerable | 2026-06-08 04:57:59.838442 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.