Liferay Portal vulnerabilities
53 known CVE vulnerabilities in Liferay Portal, translated and rated.
- CVE-2021-29047High
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after use. This allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
- CVE-2021-29040Medium
JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20, and 7.2 before fix pack 10 may return overly verbose error messages. Remote attackers can use the content of these error messages to launch more focused attacks via crafted inputs.
- CVE-2021-29039Medium
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.