NVD disclosure day

Published threat advisories for November 15, 2022

CVE-2022-42122

Liferay Friendly Url Module SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A SQL injection vulnerability in Liferay Portal and DXP allows attackers to execute arbitrary SQL commands through a crafted payload in the `title` field of a friendly URL, potentially leading to unauthorized database access or manipulation.

NVD published: November 15, 2022

CVE advisoryCRITICAL

CVE-2022-42120

Liferay Portal DXP SQL Injection Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A SQL injection vulnerability in Liferay Portal and DXP's Fragment module allows unauthenticated attackers to execute arbitrary SQL commands by manipulating a `namespace` attribute. This could lead to unauthorized access and modification of sensitive database content, impacting data integrity and system availability.

NVD published: November 15, 2022