com.liferay:com.liferay.users.admin.web@4.0.27 vulnerabilities
latest version
11.0.22
latest non vulnerable version
first published
8 years ago
latest version published
1 months ago
licenses detected
- [1.0.0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the com.liferay:com.liferay.users.admin.web package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor due to the lack of obfuscation for password reminder answers on the page. How to fix Exposure of Private Personal Information to an Unauthorized Actor? Upgrade | [,5.0.33) |
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the filename of an attachment in the Message Board widget. How to fix Cross-site Scripting (XSS)? Upgrade | [,6.0.20) |
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the How to fix Cross-site Scripting (XSS)? Upgrade | [,6.0.20) |
Affected versions of this package are vulnerable to Session Fixation due to the account lockout process not invalidating existing user sessions. A user can remain authenticated after their account has been locked. How to fix Session Fixation? Upgrade | [,5.0.5) |