GCVE - cpe:2.3:a:ez:ez_publish:3.6.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ez:ez_publish:3.6.4:*:*:*:*:*:*:*

part: a version: 3.6.4 update: *

Vendor	Ez (`7b59e160-3d8c-59e2-a2ad-e6730c6f4258`)
Product	Ez Publish (`ab65bf08-1558-5993-86c6-e15315a496e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/ezsystems/ezpublish-kernel`	purl2cpe	2026-06-01 10:12:39.081955
`pkg:github/ezsystems/ezpublish-legacy`	purl2cpe	2026-06-01 10:12:39.081956

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-6844`	vulnerable	2026-06-08 04:51:04.947869	Details available The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters. Published: 2009-07-02T10:00:00.000Z Updated: 2024-08-07T11:42:00.867Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/47216 http://www.osvdb.org/52708 http://www.securityfocus.com/bid/32762 http://ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible https://www.exploit-db.com/exploits/7406	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0938`	vulnerable	2026-06-08 04:48:55.832591	Details available Cross-site scripting (XSS) vulnerability in eZ publish 3.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the RefererURL parameter. Published: 2006-03-01T02:00:00.000Z Updated: 2024-08-07T16:56:15.594Z Open on db.gcve.eu Reference links http://www.nukedx.com/?viewdoc=16 http://www.securityfocus.com/bid/16817 https://exchange.xforce.ibmcloud.com/vulnerabilities/24956 http://www.securityfocus.com/archive/1/426076/100/0/threaded http://securitytracker.com/id?1015683	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4857`	vulnerable	2026-06-08 04:48:45.379936	Details available eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial of service (Apache httpd segmentation fault) via a request to content/advancedsearch.php with an empty SearchContentClassID parameter, reportedly related to a "memory addressing error". Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-16T16:12:42.738Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/7459	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4856`	vulnerable	2026-06-08 04:48:45.379243	Details available The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle authorization errors, which allows remote attackers to obtain sensitive information and see the admin pagelayout and associated templates via a request with (1) "anything after the url" or (2) a "wrong url". Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-17T01:21:26.782Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/6703	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4854`	vulnerable	2026-06-08 04:48:45.365252	Details available eZ publish 3.5 through 3.7 before 20050830 does not use a folder's read permissions to restrict notifications, which allows remote authenticated users to obtain sensitive information about changes to content in arbitrary folders. Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-17T01:21:28.680Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/6355	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.