Known vulnerabilities in Liferay DXP 7.4 update 1

Known vulnerabilities in Liferay DXP 7.4 update 1

Vendor: Liferay

Software: Liferay DXP

Version: 7.4 update 1

Software CPE: cpe:2.3:a:liferay:liferay_dxp:*:*:*:*:*:*:*:*

Website:

Total vulnerabilities: 9

Public exploits: 0

Known exploited (KEV): 0

Highest CVSSv4 Score: 8.7

Vulnerabilities by Severity

Vulnerabilities (9)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU105908 - Exposure of sensitive information to an unauthorized actor CVE-2025-2565	CWE-200	Medium	No	No	2024.Q1.13, 2024.Q3.1, 2024.Q4.0	21.03.2025	SB2025032102
#VU86729 - URL Redirection to Untrusted Site ('Open Redirect') CVE-2024-25609	CWE-601	Medium	No	No	7.2 fix pack 19, 7.3 update 4, 7.4 update 9	22.02.2024	SB2024022227
#VU86727 - Exposure of sensitive information to an unauthorized actor CVE-2024-26267	CWE-200	Medium	No	No	7.2 fix pack 19, 7.3 update 5, 7.4 update 26	22.02.2024	SB2024022224
#VU86717 - Improper input validation CVE-2024-26265	CWE-20	Medium	No	No	7.2 fix pack 19, 7.3 update 4, 7.4 update 16	22.02.2024	SB2024022219
#VU86715 - URL Redirection to Untrusted Site ('Open Redirect') CVE-2024-25608	CWE-601	Medium	No	No	7.2 fix pack 19, 7.3 update 4, 7.4 update 19	22.02.2024	SB2024022217
#VU86714 - Use of a Broken or Risky Cryptographic Algorithm CVE-2024-25607	CWE-327	Medium	No	No	7.2 fix pack 17, 7.3 update 4, 7.4 update 16	22.02.2024	SB2024022216
#VU86692 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2024-25606	CWE-611	Low	No	No	7.2 fix pack 20, 7.3 update 12, 7.4 update 4	21.02.2024	SB2024022130
#VU86691 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2024-25610	CWE-79	Low	No	No	7.2 fix pack 19, 7.3 update 4, 7.4 update 9	21.02.2024	SB2024022129
#VU86690 - Exposure of sensitive information to an unauthorized actor CVE-2024-26268	CWE-200	Medium	No	No	7.2 fix pack 20, 7.3 update 8, 7.4 update 27	21.02.2024	SB2024022128