Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersLiferay Publications is vulnerable to Incorrect Authorization
Liferay Portal is vulnerable to CSRF through publication comments
PowerJob OpenAPIController is missing authorization
PowerJob has Missing Authorization in its /user/list file
Liferay Portal is vulnerable to XSS through its workflow process builder
Liferay Portal's Membership page is vulnerable to XSS through “name“ text field
Liferay Portal Commerce is vulnerable to XSS through account "name" field
Elasticsearch: Insertion of Sensitive Information into Log File via reindex API
Apache StreamPark contains an Incorrect Execution-Assigned Permissions vulnerability
Liferay Portal is vulnerable to XSS through its Calendar Events parameters
Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers
Keycloak Potential Variable Reference in Model Storage Services
Opencast's Paella Player 7 is vulnerable to Cross-Site Scripting
Liferay Portal Commerce Shop is vulnerable to Stored XSS through SVG file
Liferay Portal is vulnerable to Stored XSS through Forms text type field
Liferay Portal Notifications Widget has multiple XSS vulnerabilities through various text fields
Liferay Portal is vulnerable to XSS through its Commerce Product's Name text field
Liferay Portal has multiple Stored XSS vulnerabilities on its View Order page
Liferay Portal is vulnerable to XSS through its Commerce Search Result widget
Liferay Profile Widget does not prevent vCard extension spoofing
XWiki Platform is vulnerable to HQL injection via wiki and space search REST API
XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
Liferay Portal exposes sensitive user data through its Freemarker template
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.