deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-36wv-v2qp-v4g4
Package: org.apache.cxf:cxf-core (MAVEN)
Severity: MODERATE (CVSS 5.6)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 4.0.0, < 4.0.7
Patched in: 4.0.7

Summary: Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

Details:
Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.

Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.
GitHub Security Advisory: GHSA-4q2v-9p7v-3v22
Package: io.projectreactor.netty:reactor-netty-http (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 1.2.8
Patched in: 1.2.8

Summary: Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

Details:
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
GitHub Security Advisory: GHSA-4q2v-9p7v-3v22
Package: io.projectreactor.netty:reactor-netty-http (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 1.3.0-M1, < 1.3.0-M5
Patched in: 1.3.0-M5

Summary: Reactor Netty HTTP is vulnerable to credential leaks during chained redirects

Details:
In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.
GitHub Security Advisory: GHSA-x43w-xphx-86w3
Package: com.liferay:com.liferay.object.web (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.99
Patched in: 1.0.99

Summary: Liferay Portal Vulnerable to XSS in the Object Module

Details:
Cross-site scripting (XSS) vulnerability in the Object module's edit object details page in Liferay Object Web before 1.0.99 from Liferay Portal (7.4.3.4 through 7.4.3.36) allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's `Label` text field.
GitHub Security Advisory: GHSA-67jp-27jj-6x85
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u15
Patched in: 7.4.13.u15

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module

Details:
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Frontend Editor CKEditor Web before 5.0.46 from Liferay Portal (7.3.2 through 7.4.3.14), and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
GitHub Security Advisory: GHSA-67jp-27jj-6x85
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.0, < 7.3.10.u6
Patched in: 7.3.10.u6

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module

Details:
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Frontend Editor CKEditor Web before 5.0.46 from Liferay Portal (7.3.2 through 7.4.3.14), and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
GitHub Security Advisory: GHSA-67jp-27jj-6x85
Package: com.liferay:com.liferay.frontend.editor.ckeditor.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.46
Patched in: 5.0.46

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the CKEditor Integration with the Frontend Editor Module

Details:
A Cross-site scripting (XSS) vulnerability in the Frontend Editor module's integration with CKEditor in Liferay Frontend Editor CKEditor Web before 5.0.46 from Liferay Portal (7.3.2 through 7.4.3.14), and Liferay DXP 7.3 before update 6, and 7.4 before update 15 allows remote attackers to inject arbitrary web script or HTML via the (1) name, or (2) namespace parameter.
GitHub Security Advisory: GHSA-h4c9-rr5m-32fm
Package: com.ruoyi:ruoyi (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-494: Download of Code Without Integrity Check
Vulnerable versions: < 4.7.7
Patched in: 4.7.7

Summary: RuoYi vulnerable to arbitrary file download

Details:
An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.
GitHub Security Advisory: GHSA-g6r2-6x46-jpp6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u17
Patched in: 7.4.13.u17

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module

Details:
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module before 9.1.7 from Liferay Portal (7.3.2 through 7.4.3.16), and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-g6r2-6x46-jpp6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.0, < 7.3.10.u6
Patched in: 7.3.10.u6

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module

Details:
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module before 9.1.7 from Liferay Portal (7.3.2 through 7.4.3.16), and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-g6r2-6x46-jpp6
Package: com.liferay:com.liferay.frontend.taglib.clay (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 9.1.7
Patched in: 9.1.7

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Frontend Taglib Module

Details:
A Cross-site scripting (XSS) vulnerability in the Frontend Taglib module before 9.1.7 from Liferay Portal (7.3.2 through 7.4.3.16), and Liferay DXP 7.3 before update 6, and 7.4 before update 17 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-7f7g-vhff-mjqj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u25
Patched in: 7.4.13.u25

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

Details:
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
GitHub Security Advisory: GHSA-7f7g-vhff-mjqj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.0, < 7.3.10.u5
Patched in: 7.3.10.u5

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

Details:
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
GitHub Security Advisory: GHSA-7f7g-vhff-mjqj
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, < 7.2.10.fp19
Patched in: 7.2.10.fp19

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

Details:
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
GitHub Security Advisory: GHSA-7f7g-vhff-mjqj
Package: com.liferay:com.liferay.portal.search.web (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.45
Patched in: 6.0.45

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Portal Search Module

Details:
A Cross-site scripting (XSS) vulnerability in the Portal Search module's Sort widget before 6.0.45 from Liferay Portal (7.2.0 through 7.4.3.24), and Liferay DXP 7.2 before fix pack 19, 7.3 before update 5, and DXP 7.4 before update 25 allows remote attackers to inject arbitrary web script or HTML via a crafted payload.
GitHub Security Advisory: GHSA-r32w-v775-5952
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.13.u30, <= 7.4.13.u36
Patched in: 7.4.13.u37

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module

Details:
A Cross-site scripting (XSS) vulnerability in Document Library module before 6.0.98 from Liferay Portal (7.4.3.30 through 7.4.3.36), and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter.
GitHub Security Advisory: GHSA-r32w-v775-5952
Package: com.liferay:com.liferay.document.library.web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.98
Patched in: 6.0.98

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Document Library Module

Details:
A Cross-site scripting (XSS) vulnerability in Document Library module before 6.0.98 from Liferay Portal (7.4.3.30 through 7.4.3.36), and Liferay DXP 7.4 update 30 through update 36 allows remote attackers to inject arbitrary web script or HTML via the `redirect` parameter.
GitHub Security Advisory: GHSA-cmrw-cgfc-v6x2
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u37
Patched in: 7.4.13.u37

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Role Module

Details:
A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Roles Admin Web
before 5.0.48 from Liferay Portal (7.4.0 through 7.4.3.36), and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-cmrw-cgfc-v6x2
Package: com.liferay:com.liferay.roles.admin.web (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.48
Patched in: 5.0.48

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Role Module

Details:
A Cross-site scripting (XSS) vulnerability in the Role module's edit role assignees page in Liferay Roles Admin Web
before 5.0.48 from Liferay Portal (7.4.0 through 7.4.3.36), and Liferay DXP 7.4 before update 37 allows remote attackers to inject arbitrary web script or HTML.
GitHub Security Advisory: GHSA-f43m-hhj4-q3jg
Package: com.liferay:com.liferay.portal.settings.authentication.ldap.web (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 5.0.13
Patched in: 5.0.13

Summary: Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL

Details:
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
GitHub Security Advisory: GHSA-f43m-hhj4-q3jg
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: = 7.4.0.ga1
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL

Details:
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
GitHub Security Advisory: GHSA-f43m-hhj4-q3jg
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: >= 7.3.0, < 7.3.10.u4
Patched in: 7.3.10.u4

Summary: Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL

Details:
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
GitHub Security Advisory: GHSA-f43m-hhj4-q3jg
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: >= 7.2.0, < 7.2.10.fp17
Patched in: 7.2.10.fp17

Summary: Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL

Details:
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
GitHub Security Advisory: GHSA-f43m-hhj4-q3jg
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: >= 7.1.0, < 7.1.10.fp27
Patched in: 7.1.10.fp27

Summary: Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL

Details:
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
GitHub Security Advisory: GHSA-f43m-hhj4-q3jg
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: >= 7.0.0, <= 7.0.10.fp102
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL

Details:
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
GitHub Security Advisory: GHSA-f43m-hhj4-q3jg
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: >= 7.0.0, < 7.4.3.5-ga5
Patched in: 7.4.3.5-ga5

Summary: Liferay Portal and Liferay DXP Includes LDAP Credentials in the Page URL

Details:
The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before update 4, and DXP 7.4 GA includes the LDAP credential in the page URL when paginating through the list of users, which allows man-in-the-middle attackers or attackers with access to the request logs to see the LDAP credential.
GitHub Security Advisory: GHSA-hw56-7xj4-7gx6
Package: com.liferay:com.liferay.friendly.url.service (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 4.0.3
Patched in: 4.0.3

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module

Details:
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
GitHub Security Advisory: GHSA-hw56-7xj4-7gx6
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.3.10.fp2, < 7.3.10.u4
Patched in: 7.3.10.u4

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module

Details:
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
GitHub Security Advisory: GHSA-hw56-7xj4-7gx6
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.3.7, < 7.4.0-ga1
Patched in: 7.4.0-ga1

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via Friendly URL Module

Details:
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
GitHub Security Advisory: GHSA-9427-7f65-88c8
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: < 8.0.0
Patched in: 8.0.0

Summary: Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled

Details:
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.
GitHub Security Advisory: GHSA-9427-7f65-88c8
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 7.0.0-a1, < 7.4.2-ga3
Patched in: 7.4.2-ga3

Summary: Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled

Details:
An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages.
GitHub Security Advisory: GHSA-h9ww-wjg4-jvvg
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-269: Improper Privilege Management, CWE-862: Missing Authorization
Vulnerable versions: >= 7.4.13.u8, <= 7.4.13.u36
Patched in: 7.4.13.u37

Summary: Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module

Details:
The Translation module before v2.0.58 from Liferay Portal (v7.4.3.12 through v7.4.3.36), and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
GitHub Security Advisory: GHSA-h9ww-wjg4-jvvg
Package: com.liferay:com.liferay.translation.web (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-269: Improper Privilege Management, CWE-862: Missing Authorization
Vulnerable versions: < 2.0.58
Patched in: 2.0.58

Summary: Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module

Details:
The Translation module before v2.0.58 from Liferay Portal (v7.4.3.12 through v7.4.3.36), and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.
GitHub Security Advisory: GHSA-wffm-j7m8-93g4
Package: com.liferay:com.liferay.asset.taglib (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.1.9
Patched in: 6.1.9

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name

Details:
A cross-site scripting (XSS) vulnerability in Liferay Asset Taglib before v6.1.9 from Liferay Portal (v7.3.3 through v7.4.2) and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag.
GitHub Security Advisory: GHSA-5j86-vmpx-42pc
Package: com.liferay:com.liferay.headless.discovery.web (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 4.0.12
Patched in: 4.0.12

Summary: Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module

Details:
Path traversal vulnerability in the Hypermedia REST APIs module before 4.0.12 from Liferay Portal (7.4.0 through 7.4.2) allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter.