Maven Advisories.

Liferay Portal and DXP allows users to add a note to a different virtual instance

• Broken access control

<11.0.164 · fixed in 11.0.164

Liferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field

• Cross-site scripting (XSS)

<3.0.91 · fixed in 3.0.91

H2O affected by a deserialization vulnerability

• Insecure deserialization

<=3.46.0.7 · no fixed version yet

Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource

• Broken access control

<4.0.47 · fixed in 4.0.47

Liferay Contacts Center widget has insecure direct object reference

• Broken access control

<5.0.59 · fixed in 5.0.59

Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability

• Cross-site request forgery (CSRF)

<101.0.0 · fixed in 101.0.0

Keycloak SMTP Inject Vulnerability

• Other injection

<26.2.8 || >=26.3.0, <26.3.3 · fixed in 26.2.8, 26.3.3

jinjava has Sandbox Bypass via JavaType-Based Deserialization

• Code injection

>=2.8.0, <2.8.1 || >=2.7.0, <2.7.5 · fixed in 2.8.1, 2.7.5

Jenkins has a log message injection vulnerability

• Other injection

<2.516.3 || >=2.517, <2.528 · fixed in 2.516.3, 2.528

Jenkins has a missing permission check, allowing users to obtain agent names

• Broken access control

<2.516.3 || >=2.517, <2.528 · fixed in 2.516.3, 2.528

Jenkins is missing a permission check in the authenticated users' profile menu

• Broken access control

<2.516.3 || >=2.517, <2.528 · fixed in 2.516.3, 2.528

Liferay search widget vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<8.0.93 · fixed in 8.0.93

Liferay Portal allows remote attackers to view display page templates via crafted URLs

• Broken access control

<4.0.55 · fixed in 4.0.55

Timing Attack Vulnerability in SCRAM Authentication

• CWE-208
• CWE-385

<3.2 · fixed in 3.2

Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC

• CWE-606

<101.0.0 · fixed in 101.0.0

JasperReports has a Java deserialisation vulnerability

• Insecure deserialization

<7.0.4 · fixed in 7.0.4

Spring Expression language property modification using Spring Cloud Gateway Server WebFlux

• Code injection

>=3.1.0, <=3.1.10 || >=4.0.0, <=4.1.10 || >=4.2.0, <4.2.5 || >=4.3.0, <4.3.1 · fixed in 4.2.5, 4.3.1

Spring Framework annotation detection mechanism may result in improper authorization

• Broken access control

>=5.3.0, <=5.3.44 || >=6.0.0, <=6.1.22 || >=6.2.0, <6.2.11 · fixed in 6.2.11

Spring Security annotation detection mechanism has authorization bypass

• Broken access control
• CWE-289

>=6.4.0, <6.4.10 || >=6.5.0, <6.5.4 · fixed in 6.4.10, 6.5.4

Openfire has potential identity spoofing issue via unsafe CN parsing

• Authentication bypass

<5.0.2 · fixed in 5.0.2

Liferay Stored Cross-site Scripting vulnerability

• Cross-site scripting (XSS)

<20240122.0632 · fixed in 20240122.0632

Liferay has Insecure Default Initialization of Resource issue

• CWE-1188

<5.0.111 · fixed in 5.0.111

Liferay DXP Missing Critical Step in Authentication

• Authentication bypass

<2.0.25 · fixed in 2.0.25

Liferay Portal Uses Default Password

• CWE-1393

>=7.4.0, <7.4.3.112 · fixed in 7.4.3.112

Liferay Portal Cross-site Scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<6.0.167 · fixed in 6.0.167

Liferay Portal has Improper Validation of Specified Quantity in Input

• CWE-1284

<96.0.0 · fixed in 96.0.0

Liferay Portal has External Control of System or Configuration Settings

• CWE-15

<130.0.1 · fixed in 130.0.1

Apache Fory Deserialization of Untrusted Data vulnerability

• Insecure deserialization

<0.12.2 · fixed in 0.12.2

Liferay Portal vulnerable to Cross-site Scripting

• Cross-site scripting (XSS)

<6.0.167 · fixed in 6.0.167

Liferay Portal has stored cross-site scripting (XSS) vulnerability

• Cross-site scripting (XSS)

<99.0.0 · fixed in 99.0.0

Liferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect

• Open redirect

>=2.0.7, <5.0.76 · fixed in 5.0.76

Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack

• Denial of service

>=8.0.2, <40.2.0 · fixed in 40.2.0

Liferay Portal's selection modal is vulnerable to XSS

• Cross-site scripting (XSS)

>=6.0.6, <11.0.33 · fixed in 11.0.33

Liferay Portal's Organization Selector exposes organization data to remote authenticated users

• Broken access control

>=4.0.2, <4.0.22 · fixed in 4.0.22

Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution

• Broken access control

>=6.0.2, <6.1.4 · fixed in 6.1.4

Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name

• Broken access control

>=5.0.1, <5.0.48 · fixed in 5.0.48

Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

• Broken access control

<1.0.197 · fixed in 1.0.197

Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

• Cross-site scripting (XSS)

>=5.0.76, <5.0.102 · fixed in 5.0.102

Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data

• Broken access control

<1.0.32 · fixed in 1.0.32

Liferay Portal and Liferay DXP vulnerable to Stored Cross-site Scripting

• Cross-site scripting (XSS)

<5.0.75 · fixed in 5.0.75

Liferay Portal exposes ERC which can lead to exploit the time response attack

• Cross-site scripting (XSS)
• Information disclosure

>=5.0.4, <5.0.83 · fixed in 5.0.83

Liferay Portal is vulnerable to XSS attack through its search bar portlet

• Cross-site scripting (XSS)

>=6.0.125, <6.0.143 · fixed in 6.0.143

Liferay Portal is vulnerable to XSS attacks via its remote app title field

• Cross-site scripting (XSS)

>=1.0.71, <2.0.27 · fixed in 2.0.27

Apache DolphinScheduler vulnerable to Alert Script Attack

• CWE-20

<3.2.2 · fixed in 3.2.2

Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting

• Cross-site scripting (XSS)
• Information disclosure

<4.0.94 · fixed in 4.0.94

Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin

• Cross-site scripting (XSS)

>=5.0.3, <5.0.107 · fixed in 5.0.107

Liferay Portal exposes 500 status when attempting login with a deleted client secret

• Information disclosure

>=6.0.4, <7.0.48 · fixed in 7.0.48

Liferay Portal is vulnerable to XSS attack through its Style Book theme

• Cross-site scripting (XSS)

<15.2.1 · fixed in 15.2.1

Liferay Portal is vulnerable to SSRF through custom object attachment fields

• Server-side request forgery (SSRF)

<1.0.208 · fixed in 1.0.208

XWiki Blog Application: Privilege Escalation (PR) from account through blog content

• Code injection
• Privilege escalation

<9.14 · fixed in 9.14

Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data

• Insecure deserialization

>=1.0.0, <2.22.2 · fixed in 2.22.2

Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

• Cross-site scripting (XSS)

<26.2.9 || >=26.3.0, <26.3.4 · fixed in 26.2.9, 26.3.4

FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

• Denial of service

* · no fixed version yet

Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions

• HTTP request smuggling

<4.1.125.Final || >=4.2.0.Alpha1, <4.2.5.Final · fixed in 4.1.125.Final, 4.2.5.Final

Vaadin Platform possible file bypass via upload validation on the server-side

• Unrestricted file upload
• CWE-20

>=14.0.0, <14.13.1 || >=23.0.0, <23.6.2 || >=24.0.0, <24.7.7 · fixed in 14.13.1, 23.6.2, 24.7.7

Vaadin Flow Components possible file bypass via upload validation on the server-side

• Unrestricted file upload
• CWE-20

>=2.0.0, <14.13.1 || >=23.0.0, <23.6.2 || >=24.0.0, <24.7.7 · fixed in 14.13.1, 23.6.2, 24.7.7

Vaadin Framework possible file bypass via upload validation on the server-side

• Unrestricted file upload
• CWE-20

>=7.0.0, <7.7.48 || >=8.0.0, <8.28.2 · fixed in 7.7.48, 8.28.2

Liferay Portal Vulnerable to Denial of Service in Kaleo Forms Admin

• Denial of service

<5.0.29 · fixed in 5.0.29

Netty's decoders vulnerable to DoS via zip bomb style attack

• CWE-409

<4.1.125.Final · fixed in 4.1.125.Final

XWiki configuration files can be accessed through jsx and sx endpoints

• Path traversal

>=4.2-milestone-2, <16.10.7 · fixed in 16.10.7