CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 12/03/2023 |
| CVE-2022-48366 | NIEDRIG3.7 | An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack. | 12/03/2023 |
| CVE-2022-48365 | HOCH7.2 | An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges. | 12/03/2023 |
| CVE-2021-46876 | MITTEL5.3 | An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence. | 12/03/2023 |
| CVE-2021-46875 | MITTEL6.1 | An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file. | 12/03/2023 |
| GHSA-99r3-xmmq-7q7g | KRITISCH | eZ Platform users with the Company admin role can assign any role to any user | 10/11/2022 |
| GHSA-xfqg-p48g-hh94 | KRITISCH | Login timing attack in ezsystems/ezpublish-kernel | 02/06/2022 |
| CVE-2022-25337 | KRITISCH9.8 | Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames. | 18/02/2022 |
| GHSA-44m4-9cjp-j587 | HOCH | IBX-1392: Image filenames sanitization | 21/01/2022 |
| CVE-2020-10806 | KRITISCH9.8 | eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution. | 22/03/2020 |