217 matches found
Unverified Password Change
Overview Affected versions of this package are vulnerable to Unverified Password Change via the password change process in the back office. An attacker can gain unauthorized access to change account credentials by exploiting the lack of previous password validation during the password change...
Ibexa User Bundle is missing password change validation
Impact The vulnerability is in the password change dialog in the back office. During the transition from v4 to v5 a mistake was made in the validation code which caused the validation of the previous password to not run as expected. This made it possible for a logged in user to change password in...
GHSA-X93P-W2CH-FG67 Ibexa User Bundle is missing password change validation
Impact The vulnerability is in the password change dialog in the back office. During the transition from v4 to v5 a mistake was made in the validation code which caused the validation of the previous password to not run as expected. This made it possible for a logged in user to change password in...
EUVD-2025-34901
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text...
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text
Impact This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role,...
GHSA-8C2G-F8JM-5CR7 ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text
Impact This security advisory resolves an XSS vulnerability in acronym custom tag in Rich Text, in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically means Editor or Administrator role,...
EUVD-2025-34902
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal...
GHSA-2MX6-FQ24-G2MH ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
Impact This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to exploit this vulnerability. This typically mean...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the login process. An attacker can determine the existence of user accounts by analyzing differences in error messages presented during authentication attempts. Remediation Upgrade ibexa/user to version 5.0.3 or...
EUVD-2025-34904
ibexa/user login enumerates user accounts...
GHSA-Q3X8-6898-23G3 ibexa/user login enumerates user accounts
Impact In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious. Patches See "Patched versions". Workarounds None. Resources...
ibexa/user login enumerates user accounts
Impact In v5, error messages could provide enough information to tell whether a user exists or not. This is resolved by ensuring the error messages are sufficiently ambigious. Patches See "Patched versions". Workarounds None. Resources...
EUVD-2025-29397
Malicious code in bioql PyPI...
EUVD-2023-1083
Malicious code in bioql PyPI...
EUVD-2025-18274
Malicious code in bioql PyPI...
EUVD-2024-2406
Malicious code in bioql PyPI...
EUVD-2025-18271
Malicious code in bioql PyPI...
EUVD-2023-0895
Malicious code in bioql PyPI...