CVE-2022-48366

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack...

CVE-2022-48367

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled...

CVE-2021-46876

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...

Ez Systems eZ Platform 跨站脚本漏洞

Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A security vulnerability exists in eZ Platform Ibexa Kernel versions prior to 1.3.1.1, which stems from JavaScript code that can be uploaded in .html or .js files...

Ez Systems eZ Platform 竞争条件问题漏洞

Ez Systems eZ Platform is a content management system CMS based on the Symfony framework from Ez Systems, Norway. A security vulnerability exists in Ez Systems eZ Platform Ibexa Kernel versions prior to 1.3.19. An attacker could exploit the vulnerability to determine the existence of an account v...

CVE-2022-48366

CVE-2022-48366 affects eZ Platform Ibexa Kernel prior to 1.3.19, enabling an attacker to determine whether an account exists via a timing attack (remote, no auth, no user interaction). The CVSS v3.1 vector indicates network access, high attack complexity, and no privileges required, with a low co...

CVE-2021-46876

Affected product: eZ Publish Ibexa Kernel prior to 7.5.15.1. Vulnerability: the /user/sessions endpoint can be abused to determine whether a given username or email corresponds to a valid account, enabling information disclosure. Underlying cause: listed in CVE description as an account-existence...

CVE-2021-46876

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence...

PT-2023-15741

Name of the Vulnerable Software and Affected Versions eZ Platform Ibexa Kernel versions prior to 1.3.26 Description An issue was discovered where the Company admin role gives excessive privileges, allowing users with this role to assign any role to any user, regardless of subtree limitations. Thi...

PT-2023-15742

Name of the Vulnerable Software and Affected Versions eZ Publish Ibexa Kernel versions prior to 7.5.28 Description An issue was discovered where access control based on object state is mishandled. This issue affects a policy used in roles to limit access to content based on specific object state...