Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Ibexa Subscribe
Filtered by product Ez Platform Kernel
Total 7 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-46875 1 Ibexa 1 Ez Platform Kernel 2023-03-16 N/A 6.1 MEDIUM
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
CVE-2021-46876 1 Ibexa 1 Ez Platform Kernel 2023-03-16 N/A 5.3 MEDIUM
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
CVE-2022-48365 1 Ibexa 3 Digital Experience Platform, Ez Platform, Ez Platform Kernel 2023-03-16 N/A 7.2 HIGH
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
CVE-2022-48366 1 Ibexa 7 Commerce, Digital Experience Platform, Ez Platform and 4 more 2023-03-16 N/A 3.7 LOW
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
CVE-2022-48367 1 Ibexa 5 Digital Experience Platform, Ez Platform Kernel, Ezplatform-http-cache-fastly and 2 more 2023-03-16 N/A 9.8 CRITICAL
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
CVE-2022-25337 1 Ibexa 1 Ez Platform Kernel 2022-03-03 6.8 MEDIUM 9.8 CRITICAL
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.
CVE-2022-25336 1 Ibexa 1 Ez Platform Kernel 2022-03-03 4.3 MEDIUM 5.3 MEDIUM
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.