deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9m7c-m33f-3429
Package: org.xwiki.platform:xwiki-platform-export-pdf-api (MAVEN)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer, CWE-257: Storing Passwords in a Recoverable Format
Vulnerable versions: >= 14.4.2, < 16.4.8
Patched in: 16.4.8

Summary: XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

Details:
### Impact

The PDF export uses a background job that runs on the server-side. Jobs like this have a status that is serialized in the permanent directory when the job is finished. The job status includes the job request. The PDF export job request is initialized, before the job starts, with some context information that is needed to replicate the HTTP request (used to trigger the export) in the background thread used to run the export job. This context information includes the cookies from the HTTP request that triggered the export. As a result, the user cookies (including the encrypted username and password) are stored in the permanent directory after the PDF export is finished. As the encryption key is stored in the same data directory (by default it is generated in ``data/configuration.properties``), this means that this job status contains the equivalent of the plain text password of the user who requested the PDF export.

XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory.

### Patches

This vulnerability has been patched in XWiki 16.4.8, 16.10.7 and 17.4.0RC1.

### Workarounds

We're not aware of any workarounds except for upgrading.
GitHub Security Advisory: GHSA-5c4f-pxmx-xcm4
Package: org.apache.cassandra:cassandra-all (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-267: Privilege Defined With Unsafe Actions
Vulnerable versions: = 4.0.16
Patched in: 4.0.17

Summary: Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)

Details:
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.



This issue affects Apache Cassandra 3.0.30, 3.11.17, 4.0.16, 4.1.7, 5.0.2, but this advisory is only for 4.0.16 because the fix to CVE-2025-23015 was incorrectly applied to 4.0.16, so that version is still affected.

Users in the 4.0 series are recommended to upgrade to version 4.0.17 which fixes the issue. Users from 3.0, 3.11, 4.1 and 5.0 series should follow recommendation from CVE-2025-23015.
GitHub Security Advisory: GHSA-mf9q-87xx-jgvv
Package: com.liferay:com.liferay.style.book.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type
Vulnerable versions: < 2.0.117
Patched in: 2.0.117

Summary: Liferay Portal allows unrestricted upload of file in the style books component

Details:
The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows the upload of unrestricted files in the style books component that are processed within the environment enabling arbitrary code execution by attackers.
GitHub Security Advisory: GHSA-h8gx-4hhm-w45v
Package: com.liferay:com.liferay.journal.service (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.0.161
Patched in: 7.0.161

Summary: Liferay Portal stored cross-site scripting in text field of the web content structure

Details:
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.13 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the text field from a web content.
GitHub Security Advisory: GHSA-23w4-rpc6-wpcc
Package: com.liferay:com.liferay.portal.workflow.kaleo.designer.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 5.0.145
Patched in: 5.0.145

Summary: Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet

Details:
Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92, which allows authenticated users with permissions to update Kaleo Workflows to enter a malicious Regex pattern causing their browser to hang for a very long time.
GitHub Security Advisory: GHSA-6hj4-v2qp-cqr2
Package: com.liferay:com.liferay.info.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 5.0.69
Patched in: 5.0.69

Summary: Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect

Details:
Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.
GitHub Security Advisory: GHSA-rvmf-jw8g-r35r
Package: com.liferay:com.liferay.plugins.admin.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.36
Patched in: 5.0.36

Summary: Liferay Portal vulnerable to Stored XSS in Components portlet

Details:
Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via components tab.
GitHub Security Advisory: GHSA-cv9j-mg9w-v7wm
Package: com.liferay.portal:com.liferay.portal.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-201: Insertion of Sensitive Information Into Sent Data
Vulnerable versions: < 108.1.1
Patched in: 108.1.1

Summary: Liferay Portal JSONWS API endpoint shares sensitive information

Details:
Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.
GitHub Security Advisory: GHSA-3h7r-4xxj-3mfm
Package: com.liferay:com.liferay.frontend.js.dependencies.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.25
Patched in: 1.0.25

Summary: Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html path
GitHub Security Advisory: GHSA-3h7r-4xxj-3mfm
Package: com.liferay:com.liferay.frontend.editor.ckeditor.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.107
Patched in: 5.0.107

Summary: Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.html path
GitHub Security Advisory: GHSA-h4m4-xp33-37mj
Package: com.liferay.portal:com.liferay.portal.kernel (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 155.0.0
Patched in: 155.0.0

Summary: Liferay Portal vulnerable to Reflected XSS with the referer and forward parameter

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92  allows an remote non-authenticated attacker to inject JavaScript into the referer or FORWARD_URL using %00 in those parameters.
GitHub Security Advisory: GHSA-84pp-qr92-95c9
Package: com.liferay:com.liferay.dynamic.data.mapping.form.field.type (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 6.0.187
Patched in: 6.0.187

Summary: Liferay Portal users can upload an unlimited amount of files

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.
GitHub Security Advisory: GHSA-84pp-qr92-95c9
Package: com.liferay:com.liferay.dynamic.data.mapping.form.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 4.0.180
Patched in: 4.0.180

Summary: Liferay Portal users can upload an unlimited amount of files

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allow users to upload an unlimited amount of files through the forms, the files are stored in the document_library allowing an attacker to cause a potential DDoS.
GitHub Security Advisory: GHSA-mm62-gwj5-j285
Package: com.liferay:com.liferay.object.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: < 1.0.219
Patched in: 1.0.219

Summary: Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library
GitHub Security Advisory: GHSA-mm62-gwj5-j285
Package: com.liferay:com.liferay.object.dynamic.data.mapping.form.field.type (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: < 1.0.65
Patched in: 1.0.65

Summary: Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library
GitHub Security Advisory: GHSA-mm62-gwj5-j285
Package: com.liferay:com.liferay.frontend.js.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-552: Files or Directories Accessible to External Parties
Vulnerable versions: < 5.0.125
Patched in: 5.0.125

Summary: Liferay Portal's unauthenticated users can access loaded files via URL before submitting the object entry

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded by object entry and stored in document_library
GitHub Security Advisory: GHSA-w3cr-3xw2-rp78
Package: com.liferay:com.liferay.layout.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 6.0.147
Patched in: 6.0.147

Summary: Liferay Portal users are able to add system admin portlets to pages

Details:
Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the default/main virtual instance, then any tenant can create a list of all other tenants.
GitHub Security Advisory: GHSA-fvqv-593q-qp8r
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Reflected Cross-Site Scripting Vulnerability via PortalUtil.escapeRedirect

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.6, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the PortalUtil.escapeRedirect
GitHub Security Advisory: GHSA-xwc5-q44v-p6gg
Package: com.liferay:com.liferay.login.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-203: Observable Discrepancy
Vulnerable versions: < 6.0.66
Patched in: 6.0.66

Summary: Liferay Portal User Enumeration Vulnerability via the Create Account Page

Details:
User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10 and 7.4 GA through update 92 allows remote attackers to determine if an account exist in the application via the create account page.
GitHub Security Advisory: GHSA-gj8w-ffq9-6828
Package: org.jeecgframework.boot:jeecg-boot-base-core (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.4.3, < 3.8.1
Patched in: 3.8.1

Summary: JeecgBoot SQL Injection Vulnerability

Details:
JeecgBoot versions from 3.4.3 up to 3.8.0 were found to contain a SQL injection vulnerability in the /jeecg-boot/online/cgreport/head/parseSql endpoint, which allows bypassing SQL blacklist restrictions.
GitHub Security Advisory: GHSA-gqp3-2cvr-x8m3
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 9.0.0.M1, < 9.0.108
Patched in: 9.0.108

Summary: Apache Tomcat Improper Resource Shutdown or Release vulnerability

Details:
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
GitHub Security Advisory: GHSA-gqp3-2cvr-x8m3
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 10.1.0-M1, < 10.1.44
Patched in: 10.1.44

Summary: Apache Tomcat Improper Resource Shutdown or Release vulnerability

Details:
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
GitHub Security Advisory: GHSA-gqp3-2cvr-x8m3
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 11.0.0-M1, < 11.0.10
Patched in: 11.0.10

Summary: Apache Tomcat Improper Resource Shutdown or Release vulnerability

Details:
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.

Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
GitHub Security Advisory: GHSA-jfcv-jv9g-2vx2
Package: org.bouncycastle:bctls-fips (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: = 2.73.7
Patched in: 2.73.8

Summary: Bouncy Castle for Java has Uncontrolled Resource Consumption Vulnerability

Details:
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files org/bouncycastle/crypto/fips/AESNativeCBC.Java.

This issue affects Bouncy Castle for Java FIPS: from BC-FJA 2.1.0 through 2.1.0.
GitHub Security Advisory: GHSA-jfcv-jv9g-2vx2
Package: org.bouncycastle:bc-fips (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: = 2.1.0
Patched in: 2.1.1

Summary: Bouncy Castle for Java has Uncontrolled Resource Consumption Vulnerability

Details:
Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java FIPS bc-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files org/bouncycastle/crypto/fips/AESNativeCBC.Java.

This issue affects Bouncy Castle for Java FIPS: from BC-FJA 2.1.0 through 2.1.0.
GitHub Security Advisory: GHSA-g6rx-6wfx-gj74
Package: org.bouncycastle:bc-fips (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: = 2.1.0
Patched in: 2.1.1

Summary: Bouncy Castle for Java has Out-of-Bounds Write Vulnerability

Details:
Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher.

This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0.
GitHub Security Advisory: GHSA-48cg-9c55-j2q7
Package: cn.hippo4j:hippo4j-core (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-798: Use of Hard-coded Credentials
Vulnerable versions: >= 1.0.0, <= 1.5.0
Patched in: unpatched

Summary: hippo4j Includes Hard Coded Secret Key in JWT Creation

Details:
hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems where authentication and authorization rely on the integrity of JWTs.
GitHub Security Advisory: GHSA-58cq-8wm2-6m87
Package: com.liferay:com.liferay.layout.admin.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.191
Patched in: 5.0.191

Summary: Liferay Portal Stored Cross-Site Scripting Vulnerability via GroupPagesPortlet_type Parameter

Details:
A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 allows an remote authenticated attacker to inject JavaScript into the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_type parameter.
GitHub Security Advisory: GHSA-q2gv-w583-f2vq
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Reflected Cross-Site Scripting Vulnerability via snippet Parameter

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.15, 2025.Q2.0 through 2025.Q2.2 and 2024.Q1.13 through 2024.Q1.19 allows a remote authenticated user to inject JavaScript code via snippet parameter.
GitHub Security Advisory: GHSA-x7p4-v8mj-6fxx
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 7.4.0-ga1, <= 7.4.3.132-ga132
Patched in: unpatched

Summary: Liferay Portal Username Enumeration Vulnerability

Details:
Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows attackers to determine if an account exist in the application by inspecting the server processing time of the login request.
GitHub Security Advisory: GHSA-r367-q549-pgr5
Package: com.liferay:com.liferay.layout.taglib (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 16.1.32
Patched in: 16.1.32

Summary: Liferay Portal Reflected Cross-Site Scripting Vulnerability via Form Container

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 update 32 through update 92 allows an remote authenticated user to inject JavaScript into the embedded message field from the form container.