Filtered by vendor Ibexa Subscriptions
Filtered by product Ez Platform Kernel Subscriptions
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-48367 1 Ibexa 5 Digital Experience Platform, Ez Platform Kernel, Ezplatform-http-cache-fastly and 2 more 2023-08-08 9.8 Critical
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
CVE-2022-25336 1 Ibexa 1 Ez Platform Kernel 2023-08-08 5.3 Medium
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.
CVE-2021-46875 1 Ibexa 1 Ez Platform Kernel 2023-03-16 6.1 Medium
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
CVE-2021-46876 1 Ibexa 1 Ez Platform Kernel 2023-03-16 5.3 Medium
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
CVE-2022-48365 1 Ibexa 3 Digital Experience Platform, Ez Platform, Ez Platform Kernel 2023-03-16 7.2 High
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
CVE-2022-48366 1 Ibexa 7 Commerce, Digital Experience Platform, Ez Platform and 4 more 2023-03-16 3.7 Low
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
CVE-2022-25337 1 Ibexa 1 Ez Platform Kernel 2022-03-03 9.8 Critical
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.