254 matches found
PT-2022-17219 · Ibexa +1 · Ibexa Dxp +1
Name of the Vulnerable Software and Affected Versions: Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25 Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11 Description: The issue allows Insecure Direct Object Reference IDOR attacks against image files because the...
PT-2022-17220
Name of the Vulnerable Software and Affected Versions Ibexa DXP ezsystems/ezpublish-kernel versions 7.5.x through 7.5.25 Ibexa DXP ezsystems/ezpublish-kernel versions 1.3.x through 1.3.11 Description The issue allows injection attacks via image filenames when image files are uploaded. This is...
CVE-2022-25336: Authorization Bypass Through User-Controlled Key
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference IDOR attacks against image files because the image path and filename can be correctly deduced...
CVE-2022-25337: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames...
PT-2023-12596
Name of the Vulnerable Software and Affected Versions eZ Platform Ibexa Kernel versions prior to 1.3.1.1 Description An issue allows JavaScript code to be uploaded in .html or .js files, leading to a potential XSS attack when links to these files are accessed. This can occur due to the ability to...
/user/sessions endpoint allows detecting valid accounts
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...
GHSA-GMRF-99GW-VVWJ /user/sessions endpoint allows detecting valid accounts
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...
/user/sessions endpoint allows detecting valid accounts
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...
GHSA-7VWG-39H8-8QP8 /user/sessions endpoint allows detecting valid accounts
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...
PT-2023-12597
Name of the Vulnerable Software and Affected Versions eZ Publish Ibexa Kernel versions prior to 7.5.15.1 eZ Platform versions 1.13, 2.5, and 3.2 Ibexa DXP and Ibexa Open Source version 3.3 Description An issue was discovered that allows the "/user/sessions" endpoint to be abused, enabling an...
PT-2021-24396
Name of the Vulnerable Software and Affected Versions: eZ Platform versions 1.13, 2.5, and 3.2 Ibexa DXP and Ibexa Open Source version 3.3 Description: The issue allows an attacker to detect if a given username or email refers to a valid account through differences in the response data or respons...
PT-2021-24423
Name of the Vulnerable Software and Affected Versions: eZ Platform versions 1.13, 2.5, and 3.2 Ibexa DXP and Ibexa Open Source version 3.3 Description: A security issue exists where the "/user/sessions" endpoint can be exploited to detect if a given username or email refers to a valid account. Th...
