Description
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
Remediation
References
Related Vulnerabilities
Oracle Database Server Other Vulnerability (CVE-2005-1197)
WordPress Plugin Cms Pack TimThumb Arbitrary File Upload (1.3)
Oracle HTTP Server Out-of-bounds Write Vulnerability (CVE-2022-23943)
phpMyAdmin Other Vulnerability (CVE-2007-2245)
IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1606)