p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости ezsystems/ezplatform-admin-ui-assets

За последние 30 дней в ezsystems/ezplatform-admin-ui-assets опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 3

  1. GHSA-r5rx-53g9-25rj

    Средний · CVSS 6.1Есть исправление

    Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office

    ### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. ### Patches - See "Patched versions". - https://github.com/ezsystems/ezplatform-admin-ui-assets/commit/219b71b70aaea9321947d2dbe

    ezsystems/ezplatform-admin-ui-assetsPHP
    • Обновитесь до 5.3.5
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. GHSA-4c2w-v5rq-5mx7

    Без оценкиЕсть исправление

    eZ Platform Editor Cross-site Scripting (XSS)

    This Security Advisory is about two issues of low to medium severity. We recommend that you install the update as soon as possible. There is an XSS vulnerability in CKEditor, which is used by AlloyEditor, which is used in eZ Platform Admin UI. Scripts can be injected through specially crafted "protected" comments. We are not sure it is exploitable in eZ Platform, but recommend installing it to be on the safe side. It is fixed in CKEditor v4.14, AlloyEditor v2.11.9. It is distributed via Composer, for: eZ Platform v1.13.x: ezsystems/PlatformUIAssetsBundle v4.2.3 (included from ezsystems/PlatformUIBundle v1.13.x) eZ Platform v2.5.13: ezsyste

    ezsystems/ezplatform-admin-ui-assets ezsystems/ezplatform-admin-ui-assets ezsystems/ezplatform-admin-ui-assetsPHP
    • Обновитесь до 4.2.1
    • Обновитесь до 5.0.1
    • Обновитесь до 5.1.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. GHSA-jrpw-8884-2747

    Без оценкиЕсть исправление

    eZ Platform Bundled jQuery affected by CVE-2019-11358

    In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/ This is fixed in jQuery version 3.4. We recommend that you upgrade your ezsystems/ezplatform-admin-ui-assets to v4.2.0 using Composer. This release includes jQuery 3.4.1.

    ezsystems/ezplatform-admin-ui-assetsPHP
    • Обновитесь до 4.2.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →