Security advisories

high2024-05-15

eZ Platform Object Injection in SiteAccessMatchListener

GHSA-64vj-933f-6pm3

high2024-05-15

eZ Publish Remote code execution in file uploads

GHSA-3vwr-jj4f-h98x

medium2024-05-15

eZ Platform REST API returns list of all SiteAccesses

GHSA-9wwx-c723-vm8x

low2023-11-03

Download route allows filename change in eZpublish kernel

GHSA-946c-f9w6-2c25

high2023-03-12

Company admin role gives excessive privileges in eZ Platform Ibexa

GHSA-qq2j-9pf8-g58c · CVE-2022-48365

critical2023-03-12

Access control issue in ezsystems/ezpublish-kernel

GHSA-h5v2-wrhp-5v35 · CVE-2022-48367

critical2022-11-10

eZ Platform users with the Company admin role can assign any role to any user

GHSA-99r3-xmmq-7q7g

critical2022-06-02

Login timing attack in ezsystems/ezpublish-kernel

GHSA-xfqg-p48g-hh94

critical2022-04-29

Object state limitation has no effect

GHSA-5x4f-7xgq-r42x

critical2022-02-19

Code injection in ezsystems/ezpublish-kernel

GHSA-xwv6-v7qx-f5jc · CVE-2022-25337

high2022-01-21

IBX-1392: Image filenames sanitization

GHSA-44m4-9cjp-j587

high2021-03-19

Cross-site scripting in eZ Platform Kernel

GHSA-mrvj-7q4f-5p42 · CVE-2021-46875

medium2021-03-11

/user/sessions endpoint allows detecting valid accounts

GHSA-gmrf-99gw-vvwj · CVE-2021-46876