GraphQL queries can expose password hashes

Impact Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors. Patches Affected versions: Ibexa DXP v3.3., v4.2., eZ Platform v2.5.\ Resolving versions: Ibexa...

GHSA-3P7G-WRGG-WQ45 GraphQL queries can expose password hashes

Impact Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors. Patches Affected versions: Ibexa DXP v3.3., v4.2., eZ Platform v2.5.\ Resolving versions: Ibexa...

PT-2022-28184 · Ez Systems +1 · Ez Platform +1

Name of the Vulnerable Software and Affected Versions: Ibexa DXP versions 3.3. through 3.3.27 Ibexa DXP versions 4.2. through 4.2.2 eZ Platform versions 2.5. through 2.5.30 Description: Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or...

PT-2023-15741

Name of the Vulnerable Software and Affected Versions eZ Platform Ibexa Kernel versions prior to 1.3.26 Description An issue was discovered where the Company admin role gives excessive privileges, allowing users with this role to assign any role to any user, regardless of subtree limitations. Thi...

Virtuozzo Hybrid Server 7.5 Update 3 Hotfix 2 (7.5.3-407)

The Hotfix 2 for Virtuozzo Hybrid Server 7.5 Update 3 provides new features as well as stability and usability bug fixes. Vulnerability id: PSBM-140018 Unable to set an IP address to containers based on the vzlinux-stream-9-x8664 and centos-stream-9-x8664 templates. Vulnerability id: PSBM-140305...

PT-2022-28126

Name of the Vulnerable Software and Affected Versions eZ Platform Ibexa Kernel versions prior to 1.3.19 Description The issue allows determining account existence via a timing attack, affecting privacy. Ibexa DXP's implementation of random execution time to hinder timing attacks was found to be...

GHSA-54P5-GXQ6-J98G eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php...

ezplatform-admin-ui Cross-site Scripting (XSS) vulnerability

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...

GHSA-M98Q-P5GQ-Q5FF eZ Publish Cross-site Scripting (XSS) vulnerability

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12.0 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

eZ Publish Cross-site Scripting (XSS) vulnerability

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12.0 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

PT-2023-15742

Name of the Vulnerable Software and Affected Versions eZ Publish Ibexa Kernel versions prior to 7.5.28 Description An issue was discovered where access control based on object state is mishandled. This issue affects a policy used in roles to limit access to content based on specific object state...

Improper Certificate Validation in node-sass affects eZ Platform

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects...

GHSA-6V6P-G8CG-2HGG Improper Certificate Validation in node-sass affects eZ Platform

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects...

Cedar Gate EZ-NET Cross-Site Scripting Vulnerability

Cedar Gate EZ-NET is an Internet portal application from Cedar UK. A cross-site scripting vulnerability exists in The Cedar Gate EZ-NET 6.5.5, 6.6.3, 6.7.0, and 6.8.0 that stems from The Cedar Gate EZ-NET 6.5.5, and 6.8.0 having a call to display messages to the user that do not correctly clean u...

CVE-2022-23397

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...

CVE-2022-23397

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...

Cross site scripting

DISPUTED The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im referenc...

PT-2022-15974 · Cedar Gate · Cedar Gate Ez-Net Portal

Name of the Vulnerable Software and Affected Versions: Cedar Gate EZ-NET portal versions 6.5.5 through 6.8.0 Description: The issue arises from a call to display messages to users that does not properly sanitize data sent through a URL parameter, leading to a Reflected Cross-Site Scripting...

CVE-2022-23397

The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...