File Validation Bypass

ibexa/core is vulnerable to File Validation Bypass. The vulnerability is due to inadequate file type validation within the validate function in FileExtensionBlackListValidator.php. When attempting to publish content with rejected file types, the validation fails which does prevent publication, bu...

Privilege Escalation

ibexa/core is vulnerable to privilege escalation. The vulnerability exists because the library does not properly handle the company admin role, allowing an admin user to assign any role to a user...

Timing Attack

ibexa/core is vulnerable to timing attacks. The vulnerability exists because the library uses random execution time, which is not a secure enough algorithm to be used when authenticating users into the system, resulting in sensitive user information disclosure...

Privilege Escalation

ibexa/core is vulnerable to privilege escalation. An attacker can limit the access to content based on specific object state values by using an object state limitation policy through the evaluate function of ObjectStateLimitationType.php...