eZ Publish Legacy Passwordless login for LDAP users

This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy. Installations that are using the legacy LDAP login handler or the TextFile login handler in combination with the standard legacy login handler, may ...

GHSA-P9MP-VQ4V-V5M5 eZ Publish Legacy Passwordless login for LDAP users

This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy. Installations that are using the legacy LDAP login handler or the TextFile login handler in combination with the standard legacy login handler, may ...

GHSA-2VH3-CJ9J-MCJ5 eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template

This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy via the LegacyBridge. Installations where all modules are disabled may be vulnerable to XSS injection in the module name. This is a rare configuratio...

eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities

This security advisory fixes 4 separate vulnerabilities in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy by itself or via the LegacyBridge. First, it increases the randomness, and thus the security, of the pseudo-random bytes used to generate ...

GHSA-82RV-45PC-V28W eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities

This security advisory fixes 4 separate vulnerabilities in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy by itself or via the LegacyBridge. First, it increases the randomness, and thus the security, of the pseudo-random bytes used to generate ...

Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS

his Security Advisory is about a vulnerability in VideoJS, which is bundled in DemoBundle and the ezdemo legacy extension. Older releases of VideoJS contain an XSS vulnerability in the Flash-based video player. This is bundled in DemoBundle, and in the Legacy "ezdemo" and "ezdemo-ls-extension"...

Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS

This Security Advisory is about a vulnerability in VideoJS, which is bundled in DemoBundle and the ezdemo legacy extension. Older releases of VideoJS contain an XSS vulnerability in the Flash-based video player. This is bundled in DemoBundle, and in the Legacy "ezdemo" and "ezdemo-ls-extension"...

GHSA-8C85-4RR5-CHR4 Cross-site Scripting (XSS) in DemoBundle/ezdemo bundled VideoJS

This Security Advisory is about a vulnerability in VideoJS, which is bundled in DemoBundle and the ezdemo legacy extension. Older releases of VideoJS contain an XSS vulnerability in the Flash-based video player. This is bundled in DemoBundle, and in the Legacy "ezdemo" and "ezdemo-ls-extension"...

PT-2024-40410 · Apache +1 · Apache +1

Name of the Vulnerable Software and Affected Versions: eZ Platform and Legacy affected versions not specified Description: The issue is related to how uploaded PHP and PHAR files are handled. It consists of two parts: web server configuration and disabling the PHAR stream wrapper. The sample web...

PT-2024-40034 · Ez Systems · Ez Publish Legacy

Name of the Vulnerable Software and Affected Versions: eZ Publish Legacy affected versions not specified Description: The issue concerns a vulnerability in eZ Publish Legacy that could lead to XSS injection in certain configurations, particularly when all modules are disabled. This vulnerability...

PT-2024-40352 · Ez Systems · Ez Publish Legacy +1

Name of the Vulnerable Software and Affected Versions: VideoJS versions prior to the version that fixes the XSS vulnerability eZ Publish Platform 5.4 eZ Publish Legacy 5.4 Description: The issue is related to an XSS vulnerability in the Flash-based video player of VideoJS, which is bundled in...

PT-2024-40043 · Unknown · Legacy Shop Module

Name of the Vulnerable Software and Affected Versions: Legacy shop module affected versions not specified Description: The issue concerns a vulnerability in the Legacy shop module where a backend editor can perform object injection in discount rules. This requires backend access and permission to...

PT-2024-40396 · Ez Systems · Ez Publish Legacy

Name of the Vulnerable Software and Affected Versions: eZ Publish Legacy affected versions not specified Description: The issue concerns a failure of the standard login handler to verify passwords correctly in certain configurations, potentially allowing unauthorized access. This can occur in...

PT-2024-40240 · Unknown · Ez Publish Legacy

Name of the Vulnerable Software and Affected Versions: ezpublish-legacy affected versions not specified Description: The issue is related to an information disclosure vulnerability in the legacy admin content tree menu. If a view has been disabled in site.ini SiteAccessRules Rules and an attacker...

PT-2024-40218 · Ez Systems +1 · Ez Publish Legacy +2

Name of the Vulnerable Software and Affected Versions: eZ Platform and eZ Publish Legacy affected versions not specified Description: The issue concerns a vulnerability in the way eZ Platform and eZ Publish Legacy handle file uploads, potentially leading to remote code execution RCE if an attacke...

WordPress Integration for HubSpot and Contact Form 7 plugin <=1.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Integration for Contact Form 7 HubSpot versions = 1.3.1...

Out-of-Bounds Read

FreeRDP is vulnerable to an Out-of-Bounds Read. The vulnerability is due to the legacy GDI drawing path with the /bpp:32 setting in FreeRDP, which results in Out-of-Bounds Read...

Considerations for Operational Technology Cybersecurity

Operational Technology OT refers to the hardware and software used to change, monitor, or control the enterprise's physical devices, processes, and events. Unlike traditional Information Technology IT systems, OT systems directly impact the physical world. This unique characteristic of OT brings...

xorg-x11-server: Use-after-free bug in DestroyWindow

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod mode if the pointer is warped from within a window on one screen to the root window of the othe...

kernel: drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: disable gfx9 cpeccerrorirq only when enabling legacy gfx ras gfx9 cpeccerrorirq is only enabled when legacy gfx ras is assert. So in gfxv90hwfini, interrupt disablement for cpeccerrorirq should be executed under...