Ez Archives - CVE Vulnerability

CVE-2008-6844

Sun, 26 Feb 2023 09:11:44 +0000

The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters.

The post CVE-2008-6844 appeared first on CVE Vulnerability.

CVE-2007-4493

Sun, 26 Feb 2023 09:07:15 +0000

eZ publish before 3.8.9, and 3.9 before 3.9.3, does not properly check permissions on module views that lack a policy function, which has unknown impact and attack vectors, as demonstrated by a vulnerability in the discount functionality in the shop module.

The post CVE-2007-4493 appeared first on CVE Vulnerability.

CVE-2007-4494

Sun, 26 Feb 2023 09:07:15 +0000

The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks.

The post CVE-2007-4494 appeared first on CVE Vulnerability.

CVE-2020-10806

Sun, 26 Feb 2023 06:35:58 +0000

eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.

The post CVE-2020-10806 appeared first on CVE Vulnerability.

CVE-2019-12139

Sun, 26 Feb 2023 06:29:46 +0000

An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4.

The post CVE-2019-12139 appeared first on CVE Vulnerability.