The following advisories have now been documented on the
Known Vulnerabilities page:
- CST-SA: LPS-28423 Delete any file on the server
- CST-SA: LPS-26930 Reconfigure Liferay to use a remote cache
- CST-SA: LPS-28358 SecureFilter can be bypassed
- CST-SA: LPS-28309 Directory Traversal
- CST-SA: LPS-26940 Users without the ASSIGN_MEMBER permission can still assign users to an organization
- CST-SA: LPS-26935 All JSON web services are accessible without authentication.
- CST-SA: LPS-27726 Remote code execution in Calendar portlet
This represents the currently known Severity-1 vulnerabilities for Liferay Portal 6.1 GA1. They are all fixed in the upcoming GA2 release.
Going forward, new individual vulnerabilities will be posted to this forum category, including Severity-1 and Severity-2 issues. Binary and source patches will be made available for all Severity-1 issues.
