eZ Platform Object Injection in SiteAccessMatchListener

Mô tả

Tham khảo

• ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener · WEB
• FriendsOfPHP/security-advisories · WEB
• ezsystems/ezplatform-kernel · PACKAGE
• web.archive.org/web/20201024030303/https://ezplatform.com/security-advisories/ezsa-2020-004-object-injection-in-siteaccessmatchlistener · WEB

Lỗ hổng khác của ezsystems/ezplatform-kernel

• GHSA-mwvh-p3hx-x4ggTRUNG BÌNHIbexa Kernel's files with blacklisted extensions can be still saved to drafts
• GHSA-gv2c-5g79-h73cTHẤPIbexa ezplatform-kernel download route allows filename change
• CVE-2022-48366THẤP 3.7An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
• CVE-2022-48365CAO 7.2An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
• CVE-2021-46875TRUNG BÌNH 6.1An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .ht…