com.liferay:com.liferay.login.web

3 results · Feed

• Medium 6.9
  CVE-2025-43751

  Liferay Portal User Enumeration Vulnerability via the Create Account Page

  User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 20…

  Liferay DXP Portal com.liferay:com.liferay.login.web Maven
  Aug 22, 2025
• Medium 6.3
  CVE-2021-29038

  Liferay Portal and Liferay DXP Does Not Obfuscate Password Reminder Answers

  Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and older unsupported versions does not obfuscate password reminder answers on the page, which allows attackers to use man-in-th…

  com.liferay.portal:release.dxp.bom com.liferay:com.liferay.login.web com.liferay:com.liferay.users.admin.web com.liferay.portal:portal-impl Maven
  Feb 20, 2024
• Medium 6.1
  CVE-2017-12646

  Liferay Portal XSS Vulnerability

  XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.

  com.liferay.portal:release.portal.bom com.liferay:com.liferay.login.web com.liferay:com.liferay.login.authentication.openid.connect.web Maven
  Aug 7, 2017