117 matches found
PT-2023-33021 · Ez Systems +1 · Ezpublish-Kernel +4
Name of the Vulnerable Software and Affected Versions: Ibexa DXP and eZ Platform affected versions not specified ezsystems/ezplatform-kernel affected versions not specified ezsystems/ezpublish-kernel affected versions not specified ibexa/core affected versions not specified Description: The issue...
PT-2023-33018 · Ibexa · Ibexa Dxp +1
Name of the Vulnerable Software and Affected Versions: Ibexa DXP and eZ Platform versions affected versions not specified Description: The issue allows specifying the name of the downloaded file in the route used for file downloads, which could lead to misunderstandings, confusion, and possibly...
Ez Systems eZ Platform 跨站脚本漏洞
Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A cross-site scripting vulnerability exists in Ez Systems eZ Platform version v.5.4, eZ Publish Legacy version v.5.4, which originates from a vulnerability that could allow an...
Company admin role gives excessive privileges in eZ Platform Ibexa
Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is typically only given to...
GHSA-66M4-GC8H-HPJX Timing attack in eZ Platform Ibexa
Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...
Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references. Original Description This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open...
GHSA-C737-JHWR-FQXJ Duplicate Advisory: Cross Site Scripting in eZ Platform Ibexa Kernel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mrvj-7q4f-5p42. This link is maintained to preserve external references. Original Description Impact In file upload it is possible by certain means to upload files like .html and .js. These may contain XSS...
GHSA-89P3-9J8C-FQH4 Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references. Original Description This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open...
Duplicate Advisory: Cross Site Scripting in eZ Platform Ibexa Kernel
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mrvj-7q4f-5p42. This link is maintained to preserve external references. Original Description Impact In file upload it is possible by certain means to upload files like .html and .js. These may contain XSS...
GHSA-QQ2J-9PF8-G58C Company admin role gives excessive privileges in eZ Platform Ibexa
Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is typically only given to...
CVE-2022-48366
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack...
CVE-2021-46875
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file...
CVE-2022-48365
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges...
CVE-2021-46875
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file...
Code injection
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack...
Code injection
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges...
Ez Systems eZ Platform 安全漏洞
Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A security vulnerability exists in eZ Publish Ibexa Kernel versions prior to 7.5.28, which stems from improper handling of access control...
CVE-2021-46875
CVE-2021-46875 affects eZ Platform Ibexa Kernel prior to 1.3.1.1. Multiple sources (NVD, Red Hat, CVE listing) describe a Cross-Site Scripting (XSS) vulnerability where JavaScript can be uploaded in .html or .js files, enabling script execution when victims access the uploaded content. The core i...
CVE-2022-48365
The CVE-2022-48365 issue affects eZ Platform Ibexa Kernel before 1.3.26, where the Company admin role grants excessive privileges. Impact includes elevated access to perform actions that should be restricted. The vulnerability is rooted in improper privilege management for the admin role, allowin...