/user/sessions endpoint allows detecting valid accounts

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the respons...

in001.ez-show.com Cross Site Scripting vulnerability OBB-1281342

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

eZ Publish Kernel and eZ Publish Legacy File Upload Vulnerability

eZ Systems eZ Platform is a content management system CMS based on the Symfony framework from eZ Systems Norway. eZ Publish Kernel is the kernel component of the eZ Platform. eZ Publish Legacy is a legacy version of the eZ Platform. A file upload vulnerability exists in eZ Publish Kernel and eZ...

CVE-2020-10806

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

Code injection

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

CVE-2020-10806

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

CVE-2020-10806

The CVE-2020-10806 entry affects eZ Publish Kernel and eZ Publish Legacy, where remote attackers can execute arbitrary PHP code by uploading PHP files, unless the vhost config restricts to app.php execution. Affected versions include eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x...

CVE-2020-10806: Unrestricted Upload of File with Dangerous Type

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

CVE-2019-19758

A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page...

CVE-2019-19758

Lenovo EZ Media & Backup Center (ix2, ix2-dl; v4.1.406.34763 and earlier) contains a web‑interface vulnerability that allows an unauthenticated, remote attacker to redirect a user to an untrusted webpage. Lenovo advisory LEN-30242 notes the issue and recommends discontinuing use (end of support) ...

CVE-2019-19758: URL Redirection to Untrusted Site

A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page...

CVE-2019-13522

An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Versions 1.8.41 and prior...

CVE-2019-13518

An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor Versions 2.1.0 and prior...

CVE-2019-13518

An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor Versions 2.1.0 and prior...

CVE-2019-13522

An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Versions 1.8.41 and prior...

Code injection

An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Versions 1.8.41 and prior...

CVE-2019-13518

An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the EZ Touch Editor Versions 2.1.0 and prior...

CVE-2019-13518

CVE-2019-13518 affects EZ Automation EZ Touch Editor (Versions 2.1.0 and prior). The root cause is a stack-based buffer overflow triggered by a specially crafted project file, allowing code execution with the application’s privileges. Publicly documented details come from multiple sources: Red Ha...

CVE-2019-13522

The CVE-2019-13522 affects EZAutomation EZ PLC Editor Versions 1.8.41 and earlier. Root cause: improper restriction of operations within the bounds of a memory buffer (CWE-119), leading to a memory corruption vulnerability that could allow an attacker to execute code with the application’s privil...

CVE-2019-13522

An attacker could use a specially crafted project file to corrupt the memory and execute code under the privileges of the EZ PLC Editor Versions 1.8.41 and prior...