Known vulnerabilities in Liferay DXP - page 3

Vendor: Liferay
Software: Liferay DXP
Software CPE: cpe:2.3:a:liferay:liferay_dxp:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 72
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Liferay DXP Liferay DXP is affected by 72 known vulnerabilities: 1 high, 30 medium, 41 low Critical High Medium Low

Vulnerabilities (72)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU86601 - Permissions, Privileges, and Access Controls
CVE-2022-45320		 CWE-264 Medium
No
No
 7.2 fix pack 19, 7.3 update 6, 7.4 update 16 20.02.2024 SB2024022006
#VU86600 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2023-5190		 CWE-601 Medium
No
No
 2023.Q3.6 20.02.2024 SB2024022007
#VU86273 - Exposure of sensitive information to an unauthorized actor
CVE-2024-25146		 CWE-200 Medium
No
No
 7.2 fix pack 18, 7.3 service pack 3 08.02.2024 SB2024020854
#VU86272 - Insufficient Session Expiration
CVE-2023-47798		 CWE-613 Medium
No
No
 7.2 fix pack 5 08.02.2024 SB2024020855
#VU86271 - Exposure of sensitive information to an unauthorized actor
CVE-2021-29038		 CWE-200 Medium
No
No
 7.2 fix pack 17, 7.3 service pack 1 08.02.2024 SB2024020856
#VU86270 - Cross-Site Request Forgery (CSRF)
CVE-2021-29050		 CWE-352 Low
No
No
 7.2 fix pack 11, 7.3 service pack 1 08.02.2024 SB2024020857
#VU86267 - Resource exhaustion
CVE-2024-25143		 CWE-400 Medium
No
No
 7.2 fix pack 13, 7.3 fix pack 2 08.02.2024 SB2024020858
#VU86266 - Improper input validation
CVE-2024-25144		 CWE-20 Low
No
No
 7.2 fix pack 19, 7.3 update 6, 7.4 update 27 08.02.2024 SB2024020859
#VU86264 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-25145		 CWE-79 Low
No
No
 7.2 fix pack 17, 7.3 update 4, 7.4 update 8 08.02.2024 SB2024020860
#VU86263 - Improper Access Control
CVE-2024-25148		 CWE-284 Medium
No
No
 7.2 fix pack 15, 7.3 service pack 3 08.02.2024 SB2024020861
#VU82178 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-42628		 CWE-79 Low
No
No
 7.4 update 88 18.10.2023 SB2023101808
#VU82177 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-42627		 CWE-79 Low
No
No
 7.4 update 92 18.10.2023 SB2023101807
#VU82088 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-44311		 CWE-79 Low
No
No
 7.4 update 90 17.10.2023 SB2023101728
#VU82087 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-42497		 CWE-79 Low
No
No
 7.4 update 86 17.10.2023 SB2023101727
#VU82086 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-42629		 CWE-79 Low
No
No
 7.4 update 88 17.10.2023 SB2023101726
#VU82085 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-44310		 CWE-79 Low
No
No
 7.3 update 24, 7.4 update 79 17.10.2023 SB2023101725
#VU82084 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-44309		 CWE-79 Low
No
No
 7.4 update 54 17.10.2023 SB2023101724
#VU78880 - Exposure of sensitive information to an unauthorized actor
CVE-2023-3426		 CWE-200 Low
No
No
 7.4 update 86 02.08.2023 SB2023080242
#VU76608 - Exposure of sensitive information to an unauthorized actor
CVE-2023-33948		 CWE-200 Medium
No
No
 7.4 update 68 29.05.2023 SB2023052924
#VU76606 - Exposure of sensitive information to an unauthorized actor
CVE-2023-33947		 CWE-200 Low
No
No
 7.4 update 61 29.05.2023 SB2023052923


Showing elements 41 - 60 out of 72