Most recent entries from all

certfr-2023-avi-0892 — De multiples vulnérabilités ont été découvertes dans les produits Liferay. Elles permettent à un attaquant de provoquer…

certfr-2023-avi-0892

EUVD-2026-163189

fkie_cve-2023-44311

Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.89, and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.

GHSA-49gm-5685-8fxv — Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class

Affected: Maven: com.liferay:com.liferay.oauth2.provider.rest, Maven: com.liferay.portal:release.dxp.bom

Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class before 4.0.51 from Liferay Portal (7.4.3.41 through 7.4.3.89), and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.

gsd-2023-44311

WID-SEC-W-2023-2670 — Liferay Liferay Portal: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Liferay Liferay Portal und Liferay Liferay DXP ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.