deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6v93-frf9-2rp8
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 7.4.0, <= 7.4.3.132
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP vulnerable to Server-Side Request Forgery

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, and 7.4 GA through update 92 allow a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web component due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
GitHub Security Advisory: GHSA-m8p2-495h-ccmh
Package: org.hibernate.validator:hibernate-validator (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 6.0.0.Alpha1, <= 6.0.17.Final
Patched in: 6.0.18.Final

Summary: The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

Details:
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
GitHub Security Advisory: GHSA-xwmg-2g98-w7v9
Package: com.nimbusds:nimbus-jose-jwt (MAVEN)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-674: Uncontrolled Recursion
Vulnerable versions: < 9.37.4
Patched in: 9.37.4

Summary: Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

Details:
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
GitHub Security Advisory: GHSA-3mfq-fp2f-vwqh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.4-ga, < 7.4.13.u92
Patched in: 7.4.13.u92

Summary: Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

Details:
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
GitHub Security Advisory: GHSA-3mfq-fp2f-vwqh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.3-ga, < 7.3.10.u36
Patched in: 7.3.10.u36

Summary: Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

Details:
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
GitHub Security Advisory: GHSA-3mfq-fp2f-vwqh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2023.Q3.1, < 2023.Q3.9
Patched in: 2023.Q3.9

Summary: Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

Details:
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
GitHub Security Advisory: GHSA-3mfq-fp2f-vwqh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2023.Q4.0, < 2023.Q4.6
Patched in: 2023.Q4.6

Summary: Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

Details:
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
GitHub Security Advisory: GHSA-3mfq-fp2f-vwqh
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.3.2-ga3, < 7.4.3.112-ga112
Patched in: 7.4.3.112-ga112

Summary: Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions

Details:
The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API.
GitHub Security Advisory: GHSA-j663-6jpj-xx8c
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u54
Patched in: 7.4.13.u54

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components

Details:
Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components before 3.0.25 from Liferay Portal (7.4.2 through 7.4.3.53), and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.
GitHub Security Advisory: GHSA-j663-6jpj-xx8c
Package: com.liferay:com.liferay.fragment.entry.processor.impl (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.0.25
Patched in: 3.0.25

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Fragment Components

Details:
Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components before 3.0.25 from Liferay Portal (7.4.2 through 7.4.3.53), and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked source asset.
GitHub Security Advisory: GHSA-g44j-f8wm-6622
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u88
Patched in: 7.4.13.u88

Summary: Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page

Details:
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in the Asset Categories Admin Web module before 5.0.87 from Liferay Portal (7.4.2 through 7.4.3.87), and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
GitHub Security Advisory: GHSA-g44j-f8wm-6622
Package: com.liferay:com.liferay.asset.categories.admin.web (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.87
Patched in: 5.0.87

Summary: Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page

Details:
Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in the Asset Categories Admin Web module before 5.0.87 from Liferay Portal (7.4.2 through 7.4.3.87), and Liferay DXP 7.4 before update 88 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a Vocabulary's 'description' text field.
GitHub Security Advisory: GHSA-w2g3-j73q-7qv7
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u86
Patched in: 7.4.13.u86

Summary: Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page

Details:
Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page before 2.0.86 from Liferay Portal (7.4.3.4 through 7.4.3.85), and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.
GitHub Security Advisory: GHSA-w2g3-j73q-7qv7
Package: com.liferay:com.liferay.translation.web (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.0.86
Patched in: 2.0.86

Summary: Liferay Portal and Liferay DXP Vulnerable to Reflected XSS via the Export for Translation Page

Details:
Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page before 2.0.86 from Liferay Portal (7.4.3.4 through 7.4.3.85), and Liferay DXP 7.4 before update 86 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_translation_web_internal_portlet_TranslationPortlet_redirect` parameter.
GitHub Security Advisory: GHSA-xph3-vjcq-g488
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-425: Direct Request ('Forced Browsing'), CWE-862: Missing Authorization
Vulnerable versions: >= 7.4.143.u81, <= 7.4.143.u85
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions 

Details:
The organization selector before 4.0.14 from Liferay Portal (7.4.3.81 through 7.4.3.85), and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
GitHub Security Advisory: GHSA-xph3-vjcq-g488
Package: com.liferay:com.liferay.organizations.item.selector.web (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-425: Direct Request ('Forced Browsing'), CWE-862: Missing Authorization
Vulnerable versions: < 4.0.14
Patched in: 4.0.14

Summary: Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions 

Details:
The organization selector before 4.0.14 from Liferay Portal (7.4.3.81 through 7.4.3.85), and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
GitHub Security Advisory: GHSA-qxf6-mp24-52cv
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.13.u70, <= 7.4.13.u73
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Layout Module

Details:
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
GitHub Security Advisory: GHSA-qxf6-mp24-52cv
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.3.70-ga70, < 7.4.3.74-ga74
Patched in: 7.4.3.74-ga74

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Layout Module

Details:
Cross-site scripting (XSS) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.73, and Liferay DXP 7.4 update 70 through 73 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
GitHub Security Advisory: GHSA-p2fc-xxr8-fw3p
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.4.13.u70, <= 7.4.13.u76
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module

Details:
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
GitHub Security Advisory: GHSA-p2fc-xxr8-fw3p
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.4.3.70-ga70, < 7.4.3.77-ga77
Patched in: 7.4.3.77-ga77

Summary: Liferay Portal and Liferay DXP Vulnerable to CSRF via the Layout Module

Details:
Cross-site request forgery (CSRF) vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to execute arbitrary code in the scripting console via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
GitHub Security Advisory: GHSA-22w7-m5f8-87vh
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.4.13.u70, <= 7.4.13.u76
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to Open Redirect via the Layout Module

Details:
Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
GitHub Security Advisory: GHSA-22w7-m5f8-87vh
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.4.3.70-ga70, < 7.4.3.77-ga77
Patched in: 7.4.3.77-ga77

Summary: Liferay Portal and Liferay DXP Vulnerable to Open Redirect via the Layout Module

Details:
Open redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 update 70 through 76 allows remote attackers to redirect users to arbitrary external URLs via the `_com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURL` parameter.
GitHub Security Advisory: GHSA-gxxj-fhmr-37j9
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.2.0, < 7.2.10.fp17
Patched in: 7.2.10.fp17

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module

Details:
A SQL injection vulnerability in the Layout module before 4.0.17 from Liferay Portal (7.1.3 through 7.4.3.4), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
GitHub Security Advisory: GHSA-gxxj-fhmr-37j9
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.1.0, < 7.1.10.fp27
Patched in: 7.1.10.fp27

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module

Details:
A SQL injection vulnerability in the Layout module before 4.0.17 from Liferay Portal (7.1.3 through 7.4.3.4), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
GitHub Security Advisory: GHSA-gxxj-fhmr-37j9
Package: com.liferay:com.liferay.layout.page.template.service (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 4.0.17
Patched in: 4.0.17

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Layout Module

Details:
A SQL injection vulnerability in the Layout module before 4.0.17 from Liferay Portal (7.1.3 through 7.4.3.4), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
GitHub Security Advisory: GHSA-wjfm-qxg2-q679
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.0, < 7.3.10.u8
Patched in: 7.3.10.u8

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module

Details:
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects the Commerce module before 4.0.8 from Liferay Portal (7.3.5 through 7.4.2) and Liferay DXP 7.3 before update 8.
GitHub Security Advisory: GHSA-wjfm-qxg2-q679
Package: com.liferay.commerce:com.liferay.commerce.catalog.web (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0.8
Patched in: 4.0.8

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Commerce Module

Details:
Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects the Commerce module before 4.0.8 from Liferay Portal (7.3.5 through 7.4.2) and Liferay DXP 7.3 before update 8.
GitHub Security Advisory: GHSA-mr77-4pm4-x9vm
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, < 7.2.10.fp15
Patched in: 7.2.10.fp15

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

Details:
A Cross-site scripting (XSS) vulnerability in the Portal Search module before 6.0.12 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
GitHub Security Advisory: GHSA-mr77-4pm4-x9vm
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, < 7.1.10.fp27
Patched in: 7.1.10.fp27

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

Details:
A Cross-site scripting (XSS) vulnerability in the Portal Search module before 6.0.12 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
GitHub Security Advisory: GHSA-mr77-4pm4-x9vm
Package: com.liferay:com.liferay.portal.search.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.12
Patched in: 6.0.12

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

Details:
A Cross-site scripting (XSS) vulnerability in the Portal Search module before 6.0.12 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.
GitHub Security Advisory: GHSA-2qwm-9mg5-jwq8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, < 7.2.10.fp17
Patched in: 7.2.10.fp17

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module

Details:
A Cross-site scripting (XSS) vulnerability in the Announcements module before 6.0.11 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-2qwm-9mg5-jwq8
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, < 7.1.10.fp27
Patched in: 7.1.10.fp27

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module

Details:
A Cross-site scripting (XSS) vulnerability in the Announcements module before 6.0.11 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-2qwm-9mg5-jwq8
Package: com.liferay:com.liferay.announcements.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.11
Patched in: 6.0.11

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Announcements Module

Details:
A Cross-site scripting (XSS) vulnerability in the Announcements module before 6.0.11 from Liferay Portal (7.1.0 through 7.4.2), and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-p768-r2m2-8vjr
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.0, < 7.3.10.u4
Patched in: 7.3.10.u4

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Sharing Module

Details:
A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification before 3.0.9 from Liferay Portal (7.2.1 through 7.4.2), and Liferay DXP 7.2 before fix pack 19, and 7.3 before update 4 allows remote attackers to inject arbitrary web script or HTML by sharing an asset with a crafted payload.