Threat database

4 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.1	EPSS 0.4%	CVE-2022-28980Liferay Portal · Multiple Cross-site Scripting (XSS) Medium6.1EPSS 0.4%2022-09-22CVE Database V5CVE-2022-28980 Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal v7.4.3.4 and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2022-09-22
High	7.5	EPSS 1.3%	CVE-2022-28981Hypermedia REST APIs module · Path Traversal High7.5EPSS 1.3%2022-09-22CVE Database V5CVE-2022-28981 Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter. EPSS 1.3%Vulnerability CWE-22	CVE Database V5	2022-09-22
Medium	6.1	EPSS 0.4%	CVE-2022-28982Liferay Portal · A Cross-site Scripting (XSS) Medium6.1EPSS 0.4%2022-09-21CVE Database V5CVE-2022-28982 A cross-site scripting (XSS) vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2022-09-21
Medium	6.1	EPSS 0.5%	CVE-2022-28979 · Cross-site Scripting Medium6.1EPSS 0.5%2022-09-21CVE Database V5 Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting (XSS) vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Parameter Name text field. EPSS 0.5%Vulnerability CWE-79	CVE Database V5	2022-09-21

Page 1 of 1