Foobar7

A cross-site scripting (XSS) issue exists in the Blogs widget. The widget does not include the sandbox attribute for `<iframe>` elements, potentially allowing attackers to access the parent page through scripts and links within the frame. This can be triggered by injecting a crafted `<iframe>` into the “Content” text field of a blog entry.

An Insecure Direct Object Reference (IDOR) issue exists that allows remotely authenticated users in one virtual instance to assign an organization to a user in a different virtual instance. This is achieved through manipulation of the ` com liferay users admin web portlet UsersAdminPortlet addUserIds` parameter.

An insecure direct object reference (IDOR) exists in the Publications feature. This allows remotely authenticated attackers to view the edit page of a publication by manipulating the ` com liferay change tracking web portlet PublicationsPortlet ctCollectionId` parameter.

An Insecure Direct Object Reference (IDOR) issue exists in Liferay Portal and DXP. This allows a remotely authenticated user to access addresses from different accounts. The issue is related to the ` com liferay account admin web internal portlet AccountEntriesAdminPortlet addressId` parameter.

An Insecure Direct Object Reference (IDOR) issue exists in Liferay DXP that allows authenticated remote users to access shipment addresses from different virtual instances. This occurs through the `commerceOrderId` parameter in the ` com liferay commerce order web internal portlet CommerceOrderPortlet` component.

An insecure direct object reference (IDOR) issue exists in the Publications feature. This allows remote authenticated attackers to view and edit publication comments via crafted URLs. The issue stems from improper user permission checks. The ` com liferay change tracking web portlet PublicationsPortlet value` parameter is involved in the vulnerability.

The software contains multiple stored cross-site scripting (XSS) flaws. These flaws allow a remote authenticated user to inject arbitrary web script or HTML through a crafted payload. The payload is injected into a user’s first, middle, or last name text field. This can affect several widgets and applications, including the page comments widget, blog entry comments, document and media document comments, message board messages, wiki page comments, and other widgets/apps that support mentions.

A stored cross-site scripting (XSS) issue exists in the view order page of Commerce within the affected software. This allows a remote attacker to inject arbitrary web script or HTML code by providing a crafted payload into the “Name” text field of an Account. The injected code can then be executed when other users view the order page.

A cross-site request forgery (CSRF) issue exists. This allows remote attackers to add and edit publication comments. The affected functionality does not require authentication, potentially enabling unauthorized actions.

A cross-site scripting (XSS) issue exists in the workflow process builder. This allows remote authenticated attackers to inject arbitrary web script or HTML through crafted input within a workflow definition.

A stored cross-site scripting (XSS) issue exists on the Membership page within Account Settings. This allows authenticated attackers to inject arbitrary web script or HTML code through a crafted payload. The payload is injected into the Account's “Name“ text field.

The software contains multiple cross-site scripting (XSS) issues related to Calendar events. These issues allow remote attackers to inject arbitrary web script or HTML through crafted payloads. The injection points are the (1) First Name, (2) Middle Name, and (3) Last Name text fields.

A stored cross-site scripting (XSS) issue exists in Forms within the software. This allows remote attackers to inject arbitrary web script or HTML through a crafted payload. The payload is injected into a form that uses a rich text type field.

A stored cross-site scripting (XSS) issue exists in diagram type products within Commerce in Liferay Portal and DXP. This allows remote attackers to inject arbitrary web script or HTML code through a crafted payload within an SVG file. The vulnerability affects SVG diagram components.

The Notifications widget contains multiple cross-site scripting (XSS) issues. These allow remote attackers to inject arbitrary web script or HTML through crafted payloads. The injection points include the `First Name` text field, the `Middle Name` text field, the `Last Name` text field, the “Other Reason” text field when flagging content, and the name of the flagged content. Successful exploitation could allow an attacker to execute malicious scripts in the context of a user's browser.

A cross-site scripting (XSS) issue exists in the Commerce Product Comparison Table widget. This allows remote attackers to inject arbitrary web script or HTML through a crafted payload. The payload is injected into the Commerce Product's Name text field.

The software contains multiple stored cross-site scripting (XSS) issues. These allow remote attackers to inject arbitrary web script or HTML. The injection occurs via a crafted payload in the Terms and Condition's Name text field. Specifically, the injection targets the Payment Terms and the Delivery Term on the view order page.

A cross-site scripting (XSS) issue exists in the Commerce Search Result widget. This allows remote attackers to inject arbitrary web script or HTML through a crafted payload. The payload is injected into the Commerce Product's Name text field.

The Profile widget is susceptible to a manipulation that allows authenticated remote users to alter the file extension when a vCard file is downloaded. This occurs because the widget incorporates a user’s name into the “Content-Disposition” header.

An issue exists in Liferay Portal and DXP that allows remotely authenticated users to access audit events from a different virtual instance. This occurs due to an Insecure Direct Object Reference (IDOR) condition. The issue is related to the ` com liferay portal security audit web portlet AuditPortlet auditEventId` parameter.