Filtered by vendor Ibexa Subscriptions
Total 10 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-43369 1 Ibexa 2 Ezplatform-richtext, Fieldtype-richtext 2024-08-19 7.2 High
Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format. In versions on the 4.6 branch prior to 4.6.10, the validator for the RichText fieldtype blocklists `javascript:` and `vbscript:` in links to prevent XSS. This can leave other options open, and the check can be circumvented using upper case. Content editing permissions for RichText content is required to exploit this vulnerability, which typically means Editor role or higher. The fix implements an allowlist instead, which allows only approved link protocols. The new check is case insensitive. Version 4.6.10 contains a patch for this issue. No known workarounds are available.
CVE-2020-23065 1 Ibexa 2 Ezpublish Legacy, Ezpublish Platform 2024-08-04 5.4 Medium
Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbitrary code via the video-js.swf.
CVE-2021-46876 1 Ibexa 1 Ez Platform Kernel 2024-08-04 5.3 Medium
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
CVE-2021-46875 1 Ibexa 1 Ez Platform Kernel 2024-08-04 6.1 Medium
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
CVE-2022-48367 1 Ibexa 5 Digital Experience Platform, Ez Platform Kernel, Ezplatform-http-cache-fastly and 2 more 2024-08-03 9.8 Critical
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
CVE-2022-48365 1 Ibexa 3 Digital Experience Platform, Ez Platform, Ez Platform Kernel 2024-08-03 7.2 High
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
CVE-2022-48366 1 Ibexa 7 Commerce, Digital Experience Platform, Ez Platform and 4 more 2024-08-03 3.7 Low
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
CVE-2022-41876 1 Ibexa 1 Ezplatform-graphql 2024-08-03 7.5 High
ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.
CVE-2022-25336 1 Ibexa 1 Ez Platform Kernel 2024-08-03 5.3 Medium
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.
CVE-2022-25337 1 Ibexa 1 Ez Platform Kernel 2024-08-03 9.8 Critical
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.