Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/216355?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/216355?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.1.1", "type": "composer", "namespace": "ezsystems", "name": "ezpublish-legacy", "version": "2017.12.1.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2017.12.7.4", "latest_non_vulnerable_version": "2019.03.6", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40404?format=api", "vulnerability_id": "VCID-2975-xhf4-ckcj", "summary": "Improper Access Control\nPasswordless login for LDAP users", "references": [ { "reference_url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users", "reference_id": "", "reference_type": "", "scores": [], "url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-005-passwordless-login-for-ldap-users" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56944?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.4%2B1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.4%252B1" }, { "url": "http://public2.vulnerablecode.io/api/packages/56945?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2018.6.1%2B3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2018.6.1%252B3" }, { "url": "http://public2.vulnerablecode.io/api/packages/228273?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2018.06.1.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-29ju-364n-qkch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2018.06.1.4" } ], "aliases": [ "GMS-2018-65" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2975-xhf4-ckcj" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41434?format=api", "vulnerability_id": "VCID-29ju-364n-qkch", "summary": "Content object state fetch functions open to SQL injection\n### Impact\nThis Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible.\n\n### Patches\nThe fix is distributed via Composer, see \"Patched versions\".", "references": [ { "reference_url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2021-005-content-object-state-fetch-functions-open-to-sql-injection", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2021-005-content-object-state-fetch-functions-open-to-sql-injection" }, { "reference_url": "https://github.com/ezsystems/ezpublish-legacy", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ezsystems/ezpublish-legacy" }, { "reference_url": "https://github.com/ezsystems/ezpublish-legacy/commit/f8e3a97afd92efb9148134a4bacb35a875777a42", "reference_id": "", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ezsystems/ezpublish-legacy/commit/f8e3a97afd92efb9148134a4bacb35a875777a42" }, { "reference_url": "https://github.com/advisories/GHSA-jpwx-ffjq-wr4w", "reference_id": "GHSA-jpwx-ffjq-wr4w", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-jpwx-ffjq-wr4w" }, { "reference_url": "https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-jpwx-ffjq-wr4w", "reference_id": "GHSA-jpwx-ffjq-wr4w", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-jpwx-ffjq-wr4w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/534872?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.7.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.7.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/58935?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.7%2B4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.7%252B4" }, { "url": "http://public2.vulnerablecode.io/api/packages/534880?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2019.03.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2019.03.6" }, { "url": "http://public2.vulnerablecode.io/api/packages/58936?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2019.3.6%2B1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2019.3.6%252B1" } ], "aliases": [ "GHSA-jpwx-ffjq-wr4w", "GMS-2021-112" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-29ju-364n-qkch" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39436?format=api", "vulnerability_id": "VCID-bmkb-zcyd-6kdk", "summary": "Cross-site Scripting\nSeveral vulnerabilities in Forgot password, Information collector, XML text, and Matrix field type features", "references": [ { "reference_url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-001-several-vulnerabilities-in-forgot-password-information-collector-xml-text-and-matrix-field-type-features", "reference_id": "", "reference_type": "", "scores": [], "url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-001-several-vulnerabilities-in-forgot-password-information-collector-xml-text-and-matrix-field-type-features" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55097?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.2%2B1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.2%252B1" } ], "aliases": [ "GMS-2018-64" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bmkb-zcyd-6kdk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40467?format=api", "vulnerability_id": "VCID-eaqz-xw6f-6yeb", "summary": "EZSA-2018-009 Do not interpret PHP/PHAR uploads", "references": [ { "reference_url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads", "reference_id": "", "reference_type": "", "scores": [], "url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57078?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.4%2B3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.4%252B3" }, { "url": "http://public2.vulnerablecode.io/api/packages/228273?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2018.06.1.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-29ju-364n-qkch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2018.06.1.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/56951?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2019.3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6cyy-uhhk-63aa" }, { "vulnerability": "VCID-8zn2-ztg4-s3ex" }, { "vulnerability": "VCID-qymv-b76a-2yh2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2019.3.0" } ], "aliases": [ "GMS-2018-67" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-eaqz-xw6f-6yeb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40407?format=api", "vulnerability_id": "VCID-ufw5-emg4-cqd6", "summary": "EZSA-2018-006 XSS vulnerability in 'disabled module' error template", "references": [ { "reference_url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template", "reference_id": "", "reference_type": "", "scores": [], "url": "http://share.ez.no/community-project/security-advisories/ezsa-2018-006-xss-vulnerability-in-disabled-module-error-template" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56949?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.4%2B2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.4%252B2" }, { "url": "http://public2.vulnerablecode.io/api/packages/56950?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2018.6.1%2B4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2018.6.1%252B4" }, { "url": "http://public2.vulnerablecode.io/api/packages/228273?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2018.06.1.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-29ju-364n-qkch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2018.06.1.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/56951?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2019.3.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6cyy-uhhk-63aa" }, { "vulnerability": "VCID-8zn2-ztg4-s3ex" }, { "vulnerability": "VCID-qymv-b76a-2yh2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2019.3.0" } ], "aliases": [ "GMS-2018-66" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ufw5-emg4-cqd6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/52412?format=api", "vulnerability_id": "VCID-ukn1-91je-x7hw", "summary": "Unrestricted Upload of File with Dangerous Type\neZ Publish Legacy allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only `app.php` execution.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10806", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.02833", "scoring_system": "epss", "scoring_elements": "0.86454", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.02833", "scoring_system": "epss", "scoring_elements": "0.86477", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-10806" }, { "reference_url": "https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10806", "reference_id": "CVE-2020-10806", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10806" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/250600?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.7.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-29ju-364n-qkch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.7.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/76946?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2017.12.7%2B2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.7%252B2" }, { "url": "http://public2.vulnerablecode.io/api/packages/250608?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2019.03.4.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-29ju-364n-qkch" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2019.03.4.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/76947?format=api", "purl": "pkg:composer/ezsystems/ezpublish-legacy@2019.3.4%2B2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2019.3.4%252B2" } ], "aliases": [ "CVE-2020-10806", "GHSA-54p5-gxq6-j98g" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ukn1-91je-x7hw" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/ezsystems/ezpublish-legacy@2017.12.1.1" }