Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,073
Reset filtersLiferay Portal Vulnerable to DoS via Crafted Headless API Request
Liferay Portal Vulnerable to CSRF in Headless APIs
Liferay Portal Does Not Limit Access to APIs Before Email Verification
Liferay Portal Stores Password Reset Tokens in Plain Text
Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature
Liferay Portal Vulnerable to Cross-Site Scripting
Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter
Keycloak TLS Client-Initiated Renegotiation Denial of Service
InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement
InventoryGui affected by item duplication in GUIs which use GuiStorageElement
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
Apache Tomcat Vulnerable to Relative Path Traversal
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release
Bouncy Castle Vulnerable to Uncontrolled Resource Consumption
Liferay Portal ComboServlet denial of service via large file combination
Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page
MCMS reflected cross-site scripting (XSS) vulnerability
Keycloak does not invalidate sessions when "Remember Me" is disabled
Keycloak does not invalidate offline sessions when the offline_access scope is removed
Liferay Portal and DXP do not properly restrict access to OpenAPI
Liferay Portal and DXP are Missing Authorization in Collection Provider
Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)
Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.