Liferay Portal vulnerabilities

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1. Remote attackers can inject arbitrary web script or HTML via the _com_liferay_asset_categories_admin_web_portlet_AssetCategoriesAdminPortlet_title parameter.

Cross-site scripting (XSS) vulnerability in the Redirect module's administration page in Liferay Portal 7.3.2 through 7.3.5 and Liferay DXP 7.3 before fix pack 1. Attackers can inject arbitrary web script or HTML via the destinationURL parameter.

Cross-site scripting (XSS) vulnerability in the Site module's membership request pages in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0-7.3 allows remote attackers to inject arbitrary web script or HTML via the comments parameter.

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0 through 7.3 does not obfuscate the S3 store's proxy password, allowing attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after use. This allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.

JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20, and 7.2 before fix pack 10 may return overly verbose error messages. Remote attackers can use the content of these error messages to launch more focused attacks via crafted inputs.

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.