Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, sinc...

Cross-Site Scripting (XSS)

ezsystems/ezplatform-richtext is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in custom tags allowing an attacker to inject and execute malicious javascript...

Cross-Site Scripting (XSS)

ezsystems/ezplatform-admin-ui is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in custom tags allowing an attacker to inject and execute malicious javascript...

GHSA-9JP8-CWWX-P64Q XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...

GHSA-FXWM-RX68-P5VX XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editor...

GHSA-36MJ-6R7R-MQHF User can obtain JWT token even if account is disabled

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. Someone who never had an account cannot exploit this vulnerability. The fix ensures tokens are generated only for enabled...

User can obtain JWT token even if account is disabled

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. Someone who never had an account cannot exploit this vulnerability. The fix ensures tokens are generated only for enabled...

PT-2019-12654 · Ez Platform · Ezplatform-Page-Builder +1

Name of the Vulnerable Software and Affected Versions: ezplatform-admin-ui versions 1.3.x through 1.3.4 ezplatform-admin-ui versions 1.4.x through 1.4.3 ezplatform-page-builder versions 1.1.x through 1.1.4 ezplatform-page-builder versions 1.2.x through 1.2.3 Description: A security issue was...

CVE-2019-12139: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4...