İçeriğe atla
Noroxi

Liferay kayıtları

liferay üreticisine ait 339 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
1 · %0,3
Silahlaştırılmış
1 · %0,3
Pre-auth RCE
16
Düzeltme kaydı olan
%86,1
Yayından KEV’e ortanca
593 gün

Yıllara göre kayıt

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Bug bounty kapsamı

Ürünün üreticisi herkese açık bir programda görünüyor. Eşleşme ad üzerinden yapıldı; kapsam metnini programda doğrulayın.

Tüm kayıtlar

339 kayıt
  • CVE-2020-7961
    99Hemen

    Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web ser

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99

    liferay · liferay portal20 Mar 2020

  • CVE-2019-16891
    52Planlayın

    Liferay Portal CE 6.2.5 allows remote command execution because of deserialization of a JSON payload.

    KritikCVSS 9,8Kavram kanıtıEPSS %44

    liferay · liferay portal4 Eki 2019

  • CVE-2021-33990
    43Planlayın

    Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists.

    KritikCVSS 9,8Kavram kanıtıEPSS %11

    liferay · liferay portal16 Nis 2023

  • CVE-2016-6517
    40Planlayın

    Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the

    KritikCVSS 9,8İstismar yokEPSS %2

    liferay · liferay23 Oca 2017

  • CVE-2022-42120
    39İzleyin

    A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4

    KritikCVSS 9,8İstismar yokEPSS %0

    liferay · dxp14 Kas 2022

  • CVE-2022-42122
    39İzleyin

    A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows att

    KritikCVSS 9,8İstismar yokEPSS %0

    liferay · dxp14 Kas 2022

  • CVE-2020-13445
    36İzleyin

    In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API d

    YüksekCVSS 8,8İstismar yokEPSS %3

    liferay · liferay portal10 Haz 2020

  • CVE-2010-5327
    36İzleyin

    Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.

    YüksekCVSS 8,8İstismar yokEPSS %2

    liferay · liferay portal13 Oca 2017

  • CVE-2018-10795
    36İzleyin

    Liferay 6.2.x and before has an FCKeditor configuration that allows an attacker to upload or transfer files of dangerous types that can be a

    YüksekCVSS 8,8İstismar yokEPSS %1

    liferay · liferay portal7 May 2018

  • CVE-2020-15841
    35İzleyin

    Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test

    YüksekCVSS 8,8İstismar yokEPSS %1

    liferay · digital experience platform19 Tem 2020

  • CVE-2021-29053
    35İzleyin

    Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to exe

    YüksekCVSS 8,8İstismar yokEPSS %1

    liferay · dxp17 May 2021

  • CVE-2022-42121
    35İzleyin

    A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 befo

    YüksekCVSS 8,8İstismar yokEPSS %1

    liferay · liferay portal14 Kas 2022

  • CVE-2024-38002
    35İzleyin

    The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8,

    YüksekCVSS 8,8İstismar yokEPSS %0

    liferay · digital experience platform22 Eki 2024

  • CVE-2023-35030
    35İzleyin

    Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Li

    YüksekCVSS 8,8İstismar yokEPSS %0

    liferay · dxp15 Haz 2023

  • CVE-2024-26272
    35İzleyin

    Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q

    YüksekCVSS 8,8İstismar yokEPSS %0

    liferay · digital experience platform22 Eki 2024

  • CVE-2024-26273
    35İzleyin

    Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q

    YüksekCVSS 8,8İstismar yokEPSS %0

    liferay · digital experience platform22 Eki 2024

  • CVE-2024-26271
    35İzleyin

    Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.

    YüksekCVSS 8,8İstismar yokEPSS %0

    liferay · digital experience platform22 Eki 2024

  • CVE-2021-29050
    35İzleyin

    Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service

    YüksekCVSS 8,8İstismar yokEPSS %0

    20 Şub 2024

  • CVE-2025-3594
    34İzleyin

    Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 G

    YüksekCVSS 8,6İstismar yokEPSS %0

    liferay · digital experience platform16 Haz 2025

  • CVE-2025-3526
    34İzleyin

    SessionClicks in Liferay Portal 7.0.0 through 7.4.3.21, and Liferay DXP 7.4 GA through update 9, 7.3 GA through update 25, and older unsuppo

    YüksekCVSS 8,7İstismar yokEPSS %0

    liferay · digital experience platform16 Haz 2025

  • CVE-2025-3602
    34İzleyin

    Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.Q3.1 through 2023.Q3.2, 7.4 GA through update 92, 7.3 GA through update 35, and

    YüksekCVSS 8,7İstismar yokEPSS %0

    liferay · digital experience platform16 Haz 2025

  • CVE-2024-25606
    34İzleyin

    XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before u

    YüksekCVSS 8,7İstismar yokEPSS %0

    liferay · digital experience platform20 Şub 2024

  • CVE-2020-15842
    33İzleyin

    Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-mi

    YüksekCVSS 8,1İstismar yokEPSS %1

    liferay · digital experience platform19 Tem 2020

  • CVE-2019-11444
    32İzleyin

    An issue was discovered in Liferay Portal CE 7.1.2 GA3.

    YüksekCVSS 7,2Kavram kanıtıEPSS %12

    liferay · liferay portal22 Nis 2019

  • CVE-2023-33945
    32İzleyin

    SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before updat

    YüksekCVSS 8,1İstismar yokEPSS %0

    liferay · digital experience platform24 May 2023