p PatchFirst

PatchFirst · Latest vulnerabilities

ezsystems/ezplatform-admin-ui-assets vulnerabilities

Vulnerabilities published for ezsystems/ezplatform-admin-ui-assets in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. GHSA-r5rx-53g9-25rj

    Medium · CVSS 6.1Fix available

    Ibexa eZ Platform Admin UI assets XSS vulnerabilities in back office

    ### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vulnerabilities. This typically means Editor or Administrator role, or similar. Injected XSS is persistent and can be reflected in the front office, possibly affecting end users. The fixes ensure XSS is escaped, and any existing injected XSS is rendered harmless. ### Patches - See "Patched versions". - https://github.com/ezsystems/ezplatform-admin-ui-assets/commit/219b71b70aaea9321947d2dbe

    ezsystems/ezplatform-admin-ui-assetsPHP
    • Update to 5.3.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-4c2w-v5rq-5mx7

    Not ratedFix available

    eZ Platform Editor Cross-site Scripting (XSS)

    This Security Advisory is about two issues of low to medium severity. We recommend that you install the update as soon as possible. There is an XSS vulnerability in CKEditor, which is used by AlloyEditor, which is used in eZ Platform Admin UI. Scripts can be injected through specially crafted "protected" comments. We are not sure it is exploitable in eZ Platform, but recommend installing it to be on the safe side. It is fixed in CKEditor v4.14, AlloyEditor v2.11.9. It is distributed via Composer, for: eZ Platform v1.13.x: ezsystems/PlatformUIAssetsBundle v4.2.3 (included from ezsystems/PlatformUIBundle v1.13.x) eZ Platform v2.5.13: ezsyste

    ezsystems/ezplatform-admin-ui-assets ezsystems/ezplatform-admin-ui-assets ezsystems/ezplatform-admin-ui-assetsPHP
    • Update to 4.2.1
    • Update to 5.0.1
    • Update to 5.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. GHSA-jrpw-8884-2747

    Not ratedFix available

    eZ Platform Bundled jQuery affected by CVE-2019-11358

    In eZ Platform 2.x, ezsystems/ezplatform-admin-ui-assets before v4.2.0 includes jQuery version 3.3.1. This version of jQuery is affected by the security vulnerability https://www.cvedetails.com/cve/CVE-2019-11358/ This is fixed in jQuery version 3.4. We recommend that you upgrade your ezsystems/ezplatform-admin-ui-assets to v4.2.0 using Composer. This release includes jQuery 3.4.1.

    ezsystems/ezplatform-admin-ui-assetsPHP
    • Update to 4.2.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →