The uPortal distribution (I have only looked at the -only dist) is currently breaking many of the licenses of the libraries that it distributes, mostly by not also supplying a copy of their license.

The following libraries come with the 2.3.3 uPortal-only dist, and are grouped under the license that should be included for them:

Some sort of Sun license? (not sure at all about these)
activation.jar UP-1654
jaas.jar UP-1655
jaxrpc.jar UP-1656
jdbc2_0-stdext.jar UP-1657
portlet-api-1.0.1.jar UP-1658
saaj.jar UP-1659
servlet.jar UP-1660

Apache License, Version 2.0
axis.jar UP-1661
commons-discovery.jar UP-1665
commons-logging.jar UP-1666
jakarta-oro-2.0.8.jar UP-1667
log4j-1.2.8.jar UP-1668
pluto-1.0.1.jar UP-1669
xml-apis.jar (W3C licenses already included in jar file) UP-1670
xalan.jar UP-1671

http://servlets.com/cos/license.html
cos.jar UP-1672

Hypersonic SQL Group & HSQL Development Group License
hsqldb.jar UP-1662

Common Public License Version 1.0
junit.jar UP-1673

http://tyrex.sourceforge.net/license.txt
tyrex-1.0.1.jar UP-1674

Some sort of IBM license?
wsdl4j.jar UP-1675

Apache Software License, Version 1.1
W3C Software Copyright Notice and License
xercesImpl.jar UP-1664

None required?
tidy.jar UP-1663

Unknown
portlets/GooglePortlet.war UP-1676
portlets/RssPortlet.war UP-1677
portlets/testsuite.war UP-1678