CVE-2012-1565

Technical details and affected versions are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2017-1000431

CVE-2017-1000431 affects eZ Publish: versions 5.4.0–5.4.9 and 5.3.12 and older. The vulnerability is an XSS in the search module that could allow an attacker to inject scripts and potentially steal authentication credentials. The linked sources (e.g., ezpublish advisory and security pages) confir...

CVE-2008-6844

CVE-2008-6844 affects eZ Publish vulnerable in the registration view (/user/register) prior to versions 3.9.5, 3.10.1, and 4.0.1. The underlying issue permits remote attackers to gain privileges as other users by manipulating ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_...

CVE-2003-0310

CVE-2003-0310 affects the eZ Publish web content system, specifically versions

CVE-2010-2672

The CVE-2010-2672 entry concerns eZ Publish versions 3.7.0–4.2.0. The vulnerability is a set of SQL injection flaws exploitable via user input to the search feature (parameters SectionID and SearchTimestamp) and to the advancedsearch feature (parameter SearchContentClassAttributeID). The underlyi...

CVE-2007-4493

CVE-2007-4493 affects eZ Publish prior to 3.8.9 and prior to 3.9.3; it arises from improper permission checks on module views that lack a policy function, with unknown impact and attack vectors, demonstrated by a discount vulnerability in the shop module. Remediation exists in the referenced upgr...

CVE-2005-4856

The CVE affects eZ publish: admin interface vulnerabilities in versions 3.5 up to 3.5.7, 3.6 up to 3.6.5, 3.7 up to 3.7.3, and 3.8 before 20051110. The issue arises from improper handling of authorization errors, allowing remote attackers to obtain sensitive information and view the admin page la...

CVE-2006-7218

The CVE concerns eZ Publish prior to 3.8.1. The vulnerability arises from improper enforcement of permissions for the “content edit Language” operation when four or more languages are present, allowing remote authenticated users to perform translations into languages not listed in a Module Functi...

CVE-2007-4494

The CVE-2007-4494 entry concerns eZ Publish: the tipafriend function in releases before 3.8.9 and before 3.9.3 does not restrict access for anonymous users, enabling remote spam attacks. The vulnerability is tied to insufficient access control rather than an explicit exploit described in the prov...

CVE-2005-4855

CVE-2005-4855 affects eZ publish prior to specific versions: 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050922. The issue is an unrestricted file upload that does not restrict Image datatype uploads to image content types, allowing remote authenticated users to uplo...

CVE-2005-4857

CVE-2005-4857 affects eZ publish multiple versions (3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128). The vulnerability allows remote authenticated users to cause a denial of service by sending a request to content/advancedsearch.php with an empty SearchContentClassI...

CVE-2005-4850

CVE-2005-4850 affects eZ Publish 3.5–3.7 before 20050608. The issue occurs because submitting data requires both edit and create permissions; this allows remote attackers to edit data submitted by arbitrary anonymous users. The available connected documents confirm the product/version scope and t...

CVE-2005-4852

The CVE describes a vulnerability in eZ Publish core (siteaccess URIMatching) affecting versions 3.5–3.8 prior to 20050812, where all non-alphanumeric URI characters are replaced with underscores. This allows remote attackers to bypass access restrictions by crafting URIs such as /admin:de, which...

CVE-2006-0938

The provided records indicate a Cross-site scripting (XSS) vulnerability in eZ Publish 3.7.3 and earlier, exploitable via the RefererURL parameter. Affected component: eZ Publish (version

CVE-2010-2671

CVE-2010-2671 is an XSS vulnerability in eZ Publish versions 3.7.0–4.2.0, triggered via the subTreeItem parameter in advancedsearch.php. The issue allows remote injection of arbitrary web script/HTML. The description identifies the vulnerable component and input, but the provided documents do not...

CVE-2006-7219

The CVE concerns eZ Publish before 3.8.5 where permissions for editing in a specific language are not properly enforced. This allows remote authenticated users to create a draft in an unauthorized language by editing an archived version of an object, then using Manage Versions to copy that versio...

CVE-2005-4851

CVE-2005-4851 affects eZ publish versions 3.4.4–3.7 prior to 2005-07-22. The issue arises from permissions handling at the node level, which allows remote authenticated users to bypass original permissions on embedded objects in XML fields and read those objects. Documented impact is reading of e...

CVE-2005-4854

CVE-2005-4854 affects eZ publish versions 3.5–3.7 prior to 2005-08-30. The root cause is that a folder’s read permissions are not used to restrict notifications, allowing remote authenticated users to view sensitive information about changes to content in arbitrary folders. The connected sources ...

CVE-2012-4053

The CVE-2012-4053 issue affects eZ Publish 4.1–4.6 via the eZOE Flash Player component, described as a Cross-site Request Forgery (CSRF) allowing remote attackers to hijack user authentication via unknown vectors. The provided documents do not specify exact exploitation vectors, affected products...

CVE-2005-4853

CVE-2005-4853 affects the forum package in eZ publish. In default configurations, edit permissions are not restricted to the posting’s owner, allowing remote authenticated users to edit arbitrary postings. Affected versions are: eZ publish 3.5 before 3.5.5; 3.6 before 3.6.2; 3.7 before 3.7.0rc2; ...