deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay:com.liferay.frontend.taglib.clay (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 15.2.2
Patched in: 15.2.2

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-23hv-mwm6-g8jf
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 9.0.0.M1, < 9.0.106
Patched in: 9.0.106

Summary: Apache Tomcat Session Fixation vulnerability

Details:
Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-23hv-mwm6-g8jf
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 10.1.0-M1, < 10.1.42
Patched in: 10.1.42

Summary: Apache Tomcat Session Fixation vulnerability

Details:
Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-23hv-mwm6-g8jf
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-384: Session Fixation
Vulnerable versions: >= 11.0.0-M1, < 11.0.8
Patched in: 11.0.8

Summary: Apache Tomcat Session Fixation vulnerability

Details:
Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
GitHub Security Advisory: GHSA-gqp3-2cvr-x8m3
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 9.0.0.M1, < 9.0.108
Patched in: 9.0.108

Summary: Apache Tomcat Improper Resource Shutdown or Release vulnerability

Details:
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
GitHub Security Advisory: GHSA-gqp3-2cvr-x8m3
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 10.1.0-M1, < 10.1.44
Patched in: 10.1.44

Summary: Apache Tomcat Improper Resource Shutdown or Release vulnerability

Details:
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
GitHub Security Advisory: GHSA-gqp3-2cvr-x8m3
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 11.0.0-M1, < 11.0.10
Patched in: 11.0.10

Summary: Apache Tomcat Improper Resource Shutdown or Release vulnerability

Details:
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
GitHub Security Advisory: GHSA-4cx2-fc23-5wg6
Package: org.bouncycastle:bcpkix-fips (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.0.0, <= 2.0.7
Patched in: 2.0.8

Summary: Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files  https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java ,  https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
GitHub Security Advisory: GHSA-4cx2-fc23-5wg6
Package: org.bouncycastle:bcpkix-fips (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.0.0, <= 1.0.7
Patched in: 1.0.8

Summary: Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files  https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java ,  https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java .

This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2025.q1.0, <= 2025.q1.10
Patched in: 2025.q1.11

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q1.0, <= 2024.q1.16
Patched in: 2024.q1.17

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q2.0, <= 2024.q2.13
Patched in: unpatched

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q3.0, <= 2024.q3.13
Patched in: unpatched

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q4.0, <= 2024.q4.7
Patched in: unpatched

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-m5c7-5gv3-hcpf
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, <= 7.4.3.132
Patched in: unpatched

Summary: Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
GitHub Security Advisory: GHSA-6628-q6j9-w8vg
Package: io.grpc:grpc-protobuf (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-617: Reachable Assertion
Vulnerable versions: >= 1.51.0, < 1.53.0
Patched in: 1.53.0

Summary: gRPC Reachable Assertion issue

Details:
There exists an vulnerability causing an abort() to be called in gRPC. 
The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
GitHub Security Advisory: GHSA-9hxf-ppjv-w6rq
Package: io.grpc:grpc-protobuf (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.54.0, < 1.54.2
Patched in: 1.54.2

Summary: gRPC connection termination issue

Details:
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
GitHub Security Advisory: GHSA-9hxf-ppjv-w6rq
Package: io.grpc:grpc-protobuf (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.53.0, < 1.53.1
Patched in: 1.53.1

Summary: gRPC connection termination issue

Details:
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
GitHub Security Advisory: GHSA-cfgp-2977-2fmm
Package: io.grpc:grpc-protobuf (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.54.0, < 1.54.2
Patched in: 1.54.2

Summary: Connection confusion in gRPC

Details:
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.
GitHub Security Advisory: GHSA-cfgp-2977-2fmm
Package: io.grpc:grpc-protobuf (MAVEN)
Severity: HIGH (CVSS 7.4)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.53.0, < 1.53.1
Patched in: 1.53.1

Summary: Connection confusion in gRPC

Details:
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.
GitHub Security Advisory: GHSA-222w-xmc5-jhp3
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.4, < 109.1.0
Patched in: 109.1.0

Summary: Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
GitHub Security Advisory: GHSA-222w-xmc5-jhp3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
GitHub Security Advisory: GHSA-222w-xmc5-jhp3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q1.0, < 2024.q1.13
Patched in: 2024.q1.13

Summary: Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
GitHub Security Advisory: GHSA-222w-xmc5-jhp3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q2.0, <= 2024.q2.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
GitHub Security Advisory: GHSA-222w-xmc5-jhp3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q3.0, <= 2024.q3.13
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
GitHub Security Advisory: GHSA-222w-xmc5-jhp3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2024.q4.0, <= 2024.q4.7
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
GitHub Security Advisory: GHSA-222w-xmc5-jhp3
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, <= 7.4.3.131
Patched in: 7.4.3.132

Summary: Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
GitHub Security Advisory: GHSA-cg99-m88x-422c
Package: com.liferay:com.liferay.account.admin.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2.0.138
Patched in: 2.0.138

Summary: Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability

Details:
A Denial Of Service via File Upload (DOS) vulnerability in Liferay Portal 7.4.3.0 through 7.4.3.132, Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload a profile picture of more than 300kb into a user profile. This size is more than the noted max 300kb size. This extra data can significantly slow down the Liferay service.