Known vulnerabilities in Liferay Enterprise Portal - page 8

Vendor: Liferay
Software CPE: cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 191
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Liferay Enterprise Portal Liferay Enterprise Portal is affected by 191 known vulnerabilities: 10 high, 56 medium, 125 low Critical High Medium Low

Vulnerabilities (191)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU16017 - Improper Restriction of XML External Entity Reference ('XXE')
CWE-611 Medium
No
No
7.1.1 22.11.2018 SB2018112207
#VU16016 - Session Fixation
CWE-384 Low
No
No
7.1.1 22.11.2018 SB2018112207
#VU16015 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
7.1.1 22.11.2018 SB2018112207
#VU16014 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
7.1.1 22.11.2018 SB2018112207
#VU13840 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 High
No
No
7.1 12.07.2018 SB2018071204
#VU13839 - Improper input validation
CWE-20 Low
No
No
7.1 12.07.2018 SB2018071204
#VU13838 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
7.1 12.07.2018 SB2018071204
#VU13837 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
7.1 12.07.2018 SB2018071204
#VU13836 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-601 Low
No
No
7.1 12.07.2018 SB2018071204
#VU13835 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
7.1 12.07.2018 SB2018071204
#VU13834 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
7.1 12.07.2018 SB2018071204
#VU13066 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
- 30.05.2018 SB2018053019
#VU13065 - Permissions, Privileges, and Access Controls
CWE-264 Low
No
No
- 30.05.2018 SB2018053019
#VU13064 - Missing release of memory after effective lifetime
CWE-401 Low
No
No
- 30.05.2018 SB2018053019
#VU13063 - Missing release of memory after effective lifetime
CWE-401 Low
No
No
- 30.05.2018 SB2018053019
#VU13062 - Exposure of sensitive information to an unauthorized actor
CWE-200 Low
No
No
- 30.05.2018 SB2018053019
#VU13061 - Improper input validation
CWE-20 High
No
No
- 30.05.2018 SB2018053019
#VU13060 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
- 30.05.2018 SB2018053019
#VU12397 - Unrestricted Upload of File with Dangerous Type
CVE-2018-10795
CWE-434 High
No
No
- 07.05.2018 SB2018050801
#VU12189 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
- 26.04.2018 SB2018042602


Showing elements 141 - 160 out of 191