eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

Impact The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and administrators will have the required permission. It is not persistent, i.e. the payload is only executed during the uploa...

GHSA-GC5H-6JX9-Q2QH eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

Impact The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and administrators will have the required permission. It is not persistent, i.e. the payload is only executed during the uploa...

Cache Poisoning

ezsystems/ezplatform is vulnerable to cache poisoning. The vulnerability is due to the inability to prevent front-controller script inclusion in URLs when using eZ Platform Cloud or within the .platform.app.yaml configuration file. It allows an attacker to manipulate the cache and potentially ser...

Malicious code in ez-get-url-params (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2353 Malicious code in ez-get-url-params (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-6183

A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to...

CVE-2024-6183

A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to...

CVE-2024-6183

CVE-2024-6183 affects EZ-Suite EZ-Partner 5, specifically the Forgot Password Handler component. The vulnerability is a basic cross-site scripting issue that can be exploited remotely via an unknown function in the Forgot Password Handler. Exploitation details are provided in PT-2024-37440, which...

CVE-2024-6183 EZ-Suite EZ-Partner Forgot Password cross site scripting

A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to...

CVE-2024-6183 EZ-Suite EZ-Partner Forgot Password cross site scripting

A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to...

EZ-Suite EZ-Partner Security Vulnerability

EZ-Suite EZ-Partner is a customer management system from EZ-Suite, Inc. A security vulnerability exists in EZ-Suite EZ-Partner 5. An attacker exploited the vulnerability to perform a cross-site scripting attack...

CVE-2024-6183: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability classified as problematic has been found in EZ-Suite EZ-Partner 5. Affected is an unknown function of the component Forgot Password Handler. The manipulation leads to basic cross site scripting. It is possible to launch the attack remotely. VDB-269154 is the identifier assigned to...

Access Bypass

ezsystems/ezplatform is vulnerable to Access Bypass. The vulnerability is due to inadequate rewrite rules for blocking access to executable files in the var directory when using eZ Platform Cloud on Platform.sh...

GHSA-3G43-XFRW-PV5M eZ Platform User data disclosure

In eZ Platform v2.3.x it is possible to bypass permission checks in a particular case. This means user data such as name and email but not passwords or password hashes can be read by unauthenticated users. This affects only v2.3.x. If you use v2.2.x or older you are not affected. To install, use...

eZ Platform User data disclosure

In eZ Platform v2.3.x it is possible to bypass permission checks in a particular case. This means user data such as name and email but not passwords or password hashes can be read by unauthenticated users. This affects only v2.3.x. If you use v2.2.x or older you are not affected. To install, use...

GHSA-W9P3-26FX-5MP3 eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS)

There is an XSS vulnerability in CKEditor, which is used by AlloyEditor, which is used in eZ Platform Admin UI. Scripts can be injected through specially crafted "protected" comments. We are not sure it is exploitable in eZ Platform, but recommend installing it to be on the safe side. It is fixed...

eZ Platform Admin UI is vulnerable to Cross-site Scripting (XSS)

There is an XSS vulnerability in CKEditor, which is used by AlloyEditor, which is used in eZ Platform Admin UI. Scripts can be injected through specially crafted "protected" comments. We are not sure it is exploitable in eZ Platform, but recommend installing it to be on the safe side. It is fixed...

GHSA-39J2-4P9J-5W4J Ez Platform Object Injection in legacy shop module

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...

Ez Platform Object Injection in legacy shop module

This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission...

GHSA-9895-26WR-4FGV EZsystems Remote code execution in file uploads

This Security Advisory is about a vulnerability in the way eZ Platform and eZ Publish Legacy handles file uploads, which can in the worst case lead to remote code execution RCE, a very serious threat. An attacker would need access to uploading files to be able to exploit the vulnerability, so if...