LPS-30940 cdn_host parameter allows JS injection
LPS-31063 XSS with swfuploader
LPS-31387 Fix XSS issue in reminderQueryQuestion
LPS-31090 Permission check for getLastFileVersion
LPS-31411 XSS with site names in Announcement portlet
LPS-31422 XSS with event types in Calendar
LPS-31642 XSS with site description in Site Admin
LPS-31644 XSS in custom fields
LPS-31750 fix Non-secure cookie LFR_SESSION_STATE_XXXXXX is creation when connected over HTTPS
LPS-29341 MB permission
LPS-31778 XSS in DDL
LPS-31823 XSS in Search portlet if results are displayed in document form
LPS-31824 XSS with previews in Wiki
LPS-32064 XSS with custom fields
LPS-32528 Properly escape asset category description in asset category display form
LPS-32562
LPS-33183
LPS-33275 XSS with category names in Message Boards
LPS-33477 the javascript injection issue(XSS) occurs when the Reviewer is viewing comments of pending status in My Workflow Tasks
LPS-29872 Changed organizationIds type from long[] to Long[] as SQL processing we are searching for Long[] and based on my analysis I found we usually use Long[] for organizationIds