com.liferay.portal:portal-impl@5.2.3 vulnerabilities
-
latest version
6.2.5
-
first published
14 years ago
-
latest version published
8 years ago
-
licenses detected
- [5.2.3,6.0.2)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the com.liferay.portal:portal-impl package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
com.liferay.portal:portal-impl is a Portal Impl Affected versions of this package are vulnerable to Exposure of Private Personal Information to an Unauthorized Actor due to the lack of obfuscation for password reminder answers on the page. How to fix Exposure of Private Personal Information to an Unauthorized Actor? Upgrade |
[,5.18.4)
|
com.liferay.portal:portal-impl is a Portal Impl Affected versions of this package are vulnerable to OS Command Injection via a crafted Velocity template. An attacker can execute arbitrary shell commands by sending a malicious request to the server. How to fix OS Command Injection? Upgrade |
[,6.1.1)
|
com.liferay.portal:portal-impl is a Portal Impl Affected versions of this package are vulnerable to Arbitrary File Upload which allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. How to fix Arbitrary File Upload? A fix was pushed into the |
[0,)
|
com.liferay.portal:portal-impl is a Portal Impl Affected versions of this package are vulnerable to Information Exposure in the JSON web services. It may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused attacks via crafted inputs. How to fix Information Exposure? Upgrade |
[,5.18.3)
|
com.liferay.portal:portal-impl is a Portal Impl Affected versions of this package are vulnerable to Deserialization of Untrusted Data. Deserialization of Untrusted Data in Liferay Portal allows remote attackers to execute arbitrary code via JSON web services (JSONWS). How to fix Deserialization of Untrusted Data? There is no fixed version for |
[0,)
|