1011 matches found
CVE-2022-48365
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges...
CVE-2021-46875
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file...
CVE-2022-48367
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled...
CVE-2022-48365
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges...
CVE-2022-48366
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack...
Ez Systems eZ Platform 安全漏洞
Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. Ibexa Kernel eZ Platform A security vulnerability exists in Ibexa Kernel versions prior to 1.3.26, which stems from granting too many privileges to the corporate administrator role...
Ez Systems eZ Platform 竞争条件问题漏洞
Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A security vulnerability exists in Ez Systems eZ Platform Ibexa Kernel versions prior to 1.3.19. An attacker could exploit the vulnerability to determine the existence of an account v...
CVE-2021-46876
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...
CVE-2022-48367
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled...
CVE-2022-48366
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack...
Ez Systems eZ Platform 安全漏洞
Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A security vulnerability exists in Ez Systems eZ Publish Ibexa Kernel versions prior to 7.5.15.1, which stems from misuse of the /user/sessions endpoint to determine if an account...
Ez Systems eZ Platform 跨站脚本漏洞
Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A security vulnerability exists in eZ Platform Ibexa Kernel versions prior to 1.3.1.1, which stems from JavaScript code that can be uploaded in .html or .js files...
CVE-2022-48365: Improper Privilege Management
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges...
CVE-2022-48367: Missing Authorization
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled...
CVE-2021-46876
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...
CVE-2021-46876
Affected product: eZ Publish Ibexa Kernel prior to 7.5.15.1. Vulnerability: the /user/sessions endpoint can be abused to determine whether a given username or email corresponds to a valid account, enabling information disclosure. Underlying cause: listed in CVE description as an account-existence...
CVE-2022-48366
CVE-2022-48366 affects eZ Platform Ibexa Kernel prior to 1.3.19, enabling an attacker to determine whether an account exists via a timing attack (remote, no auth, no user interaction). The CVSS v3.1 vector indicates network access, high attack complexity, and no privileges required, with a low co...
SUSE CVE-2003-0887
ez-ipupdate 3.0.11b7 and earlier creates insecure temporary cache files, which allows local users to conduct unauthorized operations via a symlink attack on the ez-ipupdate.cache file...
SUSE CVE-2004-0980
Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code...
eZ Platform users with the Company admin role can assign any role to any user
Critical severity. Users with the Company admin role introduced by the company account feature in v4 can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect. The role / assign policy is...