CVE-2022-48367

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled...

CVE-2021-46876

Affected product: eZ Publish Ibexa Kernel prior to 7.5.15.1. Vulnerability: the /user/sessions endpoint can be abused to determine whether a given username or email corresponds to a valid account, enabling information disclosure. Underlying cause: listed in CVE description as an account-existence...

CVE-2022-48366

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack...

PT-2023-15742

Name of the Vulnerable Software and Affected Versions eZ Publish Ibexa Kernel versions prior to 7.5.28 Description An issue was discovered where access control based on object state is mishandled. This issue affects a policy used in roles to limit access to content based on specific object state...