| 0 |
| url |
VCID-2jxf-hfxq-skg7 |
| vulnerability_id |
VCID-2jxf-hfxq-skg7 |
| summary |
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@5.2.2 |
| purl |
pkg:pypi/plone@5.2.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 1 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 2 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 3 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 4 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 5 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 6 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 7 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 8 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 9 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 10 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 11 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 12 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2 |
|
|
| aliases |
CVE-2020-7941, GHSA-w6g9-xccc-347h, PYSEC-2020-90
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2jxf-hfxq-skg7 |
|
| 1 |
| url |
VCID-311f-xecp-47fm |
| vulnerability_id |
VCID-311f-xecp-47fm |
| summary |
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
7.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.16 |
| purl |
pkg:pypi/plone@4.3.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 6 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 7 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 19 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16 |
|
| 1 |
| url |
pkg:pypi/plone@5.1.0 |
| purl |
pkg:pypi/plone@5.1.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 12 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 13 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 14 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 15 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 16 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 17 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0 |
|
|
| aliases |
CVE-2017-1000483, GHSA-qc57-h2f7-p4hx, PYSEC-2018-72
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-311f-xecp-47fm |
|
| 2 |
| url |
VCID-36rb-6jkw-j7d8 |
| vulnerability_id |
VCID-36rb-6jkw-j7d8 |
| summary |
Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
| reference_url |
http://www.securityfocus.com/bid/92752 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
http://www.securityfocus.com/bid/92752 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
|
| aliases |
CVE-2016-7135, GHSA-m7f9-65wr-pwch, PYSEC-2017-58
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-36rb-6jkw-j7d8 |
|
| 3 |
| url |
VCID-36xh-ua3s-gyfr |
| vulnerability_id |
VCID-36xh-ua3s-gyfr |
| summary |
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role). |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@5.2.3 |
| purl |
pkg:pypi/plone@5.2.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 1 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 2 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 3 |
| vulnerability |
VCID-ccuu-86vs-s3gs |
|
| 4 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 5 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 6 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 7 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 8 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 9 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 10 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3 |
|
|
| aliases |
CVE-2020-28736, GHSA-2c8c-84w2-j38j, PYSEC-2020-248
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-36xh-ua3s-gyfr |
|
| 4 |
| url |
VCID-3n34-5rm7-nbcj |
| vulnerability_id |
VCID-3n34-5rm7-nbcj |
| summary |
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-33510, GHSA-4mg4-wvmx-5332, PYSEC-2021-82
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3n34-5rm7-nbcj |
|
| 5 |
| url |
VCID-3s9q-6gvu-qyef |
| vulnerability_id |
VCID-3s9q-6gvu-qyef |
| summary |
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.20 |
| purl |
pkg:pypi/plone@4.3.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 6 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 7 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 19 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.20 |
|
| 1 |
| url |
pkg:pypi/plone@5.1.7 |
| purl |
pkg:pypi/plone@5.1.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 12 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 13 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 14 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 15 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 16 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 17 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.7 |
|
| 2 |
| url |
pkg:pypi/plone@5.2.1 |
| purl |
pkg:pypi/plone@5.2.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 4 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 5 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 6 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 7 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 8 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 9 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 10 |
| vulnerability |
VCID-hmam-sbwn-afh2 |
|
| 11 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 12 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 13 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 14 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 15 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 16 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 17 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.1 |
|
| 3 |
| url |
pkg:pypi/plone@5.2.2 |
| purl |
pkg:pypi/plone@5.2.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 1 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 2 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 3 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 4 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 5 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 6 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 7 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 8 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 9 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 10 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 11 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 12 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2 |
|
|
| aliases |
CVE-2020-7940, GHSA-cw58-gpgw-hwx2, PYSEC-2020-89
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3s9q-6gvu-qyef |
|
| 6 |
| url |
VCID-43m1-jkv8-jygp |
| vulnerability_id |
VCID-43m1-jkv8-jygp |
| summary |
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.16 |
| purl |
pkg:pypi/plone@4.3.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 6 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 7 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 19 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16 |
|
| 1 |
| url |
pkg:pypi/plone@5.1.0 |
| purl |
pkg:pypi/plone@5.1.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 12 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 13 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 14 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 15 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 16 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 17 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0 |
|
|
| aliases |
CVE-2017-1000482, GHSA-859j-668v-mrr6, PYSEC-2018-71
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-43m1-jkv8-jygp |
|
| 7 |
| url |
VCID-4bjr-mjug-gqd2 |
| vulnerability_id |
VCID-4bjr-mjug-gqd2 |
| summary |
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.7 |
| purl |
pkg:pypi/plone@4.3.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 10 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 11 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 12 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 15 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 16 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 17 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 18 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 19 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 20 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 21 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 22 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 23 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 24 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 25 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 26 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 27 |
| vulnerability |
VCID-w2u3-bnqq-mqfz |
|
| 28 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 29 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 30 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 31 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.7 |
|
| 1 |
| url |
pkg:pypi/plone@5.0rc2 |
| purl |
pkg:pypi/plone@5.0rc2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 8 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 9 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 10 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 11 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 19 |
| vulnerability |
VCID-w2u3-bnqq-mqfz |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0rc2 |
|
|
| aliases |
CVE-2015-7315, GHSA-984m-rj28-8c6x, PYSEC-2017-52
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4bjr-mjug-gqd2 |
|
| 8 |
| url |
VCID-5e2c-6mkx-4udu |
| vulnerability_id |
VCID-5e2c-6mkx-4udu |
| summary |
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-33511, GHSA-gc9g-67cq-p7v4, PYSEC-2021-83
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5e2c-6mkx-4udu |
|
| 9 |
| url |
VCID-5kaj-zugj-mbh1 |
| vulnerability_id |
VCID-5kaj-zugj-mbh1 |
| summary |
Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
|
| aliases |
CVE-2016-7140, GHSA-chvw-gjxf-f8mc, PYSEC-2017-63
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5kaj-zugj-mbh1 |
|
| 10 |
| url |
VCID-5tbn-qmuj-jya9 |
| vulnerability_id |
VCID-5tbn-qmuj-jya9 |
| summary |
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
| reference_url |
https://www.exploit-db.com/exploits/38411 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://www.exploit-db.com/exploits/38411 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@5.0a1 |
| purl |
pkg:pypi/plone@5.0a1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 5 |
| vulnerability |
VCID-4bjr-mjug-gqd2 |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 21 |
| vulnerability |
VCID-w2u3-bnqq-mqfz |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-yaa8-vy4x-cqbq |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0a1 |
|
|
| aliases |
CVE-2015-7293, GHSA-p3qm-44cf-f8qx, PYSEC-2017-51
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5tbn-qmuj-jya9 |
|
| 11 |
| url |
VCID-5z33-3pqj-gygw |
| vulnerability_id |
VCID-5z33-3pqj-gygw |
| summary |
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@5.2.3 |
| purl |
pkg:pypi/plone@5.2.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 1 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 2 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 3 |
| vulnerability |
VCID-ccuu-86vs-s3gs |
|
| 4 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 5 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 6 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 7 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 8 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 9 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 10 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3 |
|
|
| aliases |
CVE-2020-28734, GHSA-wq6x-g685-w5f2, PYSEC-2020-246
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5z33-3pqj-gygw |
|
| 12 |
| url |
VCID-6898-z4k5-h3b6 |
| vulnerability_id |
VCID-6898-z4k5-h3b6 |
| summary |
Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
|
| aliases |
CVE-2016-7147, GHSA-84jm-cpc5-c7g7, PYSEC-2017-64
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6898-z4k5-h3b6 |
|
| 13 |
| url |
VCID-9ze6-mfrw-ukdv |
| vulnerability_id |
VCID-9ze6-mfrw-ukdv |
| summary |
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-33513, GHSA-fj67-w3m4-rfmp, PYSEC-2021-85
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9ze6-mfrw-ukdv |
|
| 14 |
| url |
VCID-d68e-uehc-nudc |
| vulnerability_id |
VCID-d68e-uehc-nudc |
| summary |
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
9.9 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
|
| 1 |
| value |
9.4 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-33509, GHSA-hm2p-fhwx-9285, PYSEC-2021-81
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-d68e-uehc-nudc |
|
| 15 |
| url |
VCID-fga8-ymex-67fw |
| vulnerability_id |
VCID-fga8-ymex-67fw |
| summary |
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/advisories/GHSA-xvwv-6wvx-px9x |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-xvwv-6wvx-px9x |
|
| 2 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.16 |
| purl |
pkg:pypi/plone@4.3.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 6 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 7 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 19 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16 |
|
| 1 |
| url |
pkg:pypi/plone@5.1.0 |
| purl |
pkg:pypi/plone@5.1.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 12 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 13 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 14 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 15 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 16 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 17 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0 |
|
|
| aliases |
CVE-2017-1000484, GHSA-xvwv-6wvx-px9x, PYSEC-2018-73
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fga8-ymex-67fw |
|
| 16 |
| url |
VCID-gejv-h449-13e4 |
| vulnerability_id |
VCID-gejv-h449-13e4 |
| summary |
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.20 |
| purl |
pkg:pypi/plone@4.3.20 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 6 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 7 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 19 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.20 |
|
| 1 |
| url |
pkg:pypi/plone@5.1.7 |
| purl |
pkg:pypi/plone@5.1.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 12 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 13 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 14 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 15 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 16 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 17 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.7 |
|
| 2 |
| url |
pkg:pypi/plone@5.2.2 |
| purl |
pkg:pypi/plone@5.2.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 1 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 2 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 3 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 4 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 5 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 6 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 7 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 8 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 9 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 10 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 11 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 12 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2 |
|
|
| aliases |
CVE-2020-7936, GHSA-82j9-wfcf-9v2h, PYSEC-2020-85
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gejv-h449-13e4 |
|
| 17 |
| url |
VCID-gsnt-c1cd-d3bf |
| vulnerability_id |
VCID-gsnt-c1cd-d3bf |
| summary |
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.10 |
| purl |
pkg:pypi/plone@4.3.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 10 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 11 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 12 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 15 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 16 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 17 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 18 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 19 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 20 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 21 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 22 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 23 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 24 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 25 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 26 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 27 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 28 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 29 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 30 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.10 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.5 |
| purl |
pkg:pypi/plone@5.0.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 10 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 11 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 12 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 15 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 16 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 17 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 18 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 19 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 20 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 21 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 22 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 23 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 24 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 25 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 26 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 27 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 28 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 29 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 30 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 31 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 32 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.5 |
|
| 2 |
| url |
pkg:pypi/plone@5.1a2 |
| purl |
pkg:pypi/plone@5.1a2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 18 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 19 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a2 |
|
|
| aliases |
CVE-2016-4042, GHSA-v4vj-49m5-wjhw, PYSEC-2017-56
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gsnt-c1cd-d3bf |
|
| 18 |
| url |
VCID-m91w-vguw-qkem |
| vulnerability_id |
VCID-m91w-vguw-qkem |
| summary |
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
| reference_url |
http://www.securityfocus.com/bid/92752 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
http://www.securityfocus.com/bid/92752 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
|
| aliases |
CVE-2016-7138, GHSA-v3hp-f8qr-cf3p, PYSEC-2017-61
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m91w-vguw-qkem |
|
| 19 |
| url |
VCID-njnv-5cwt-4ygy |
| vulnerability_id |
VCID-njnv-5cwt-4ygy |
| summary |
Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
| reference_url |
http://www.securityfocus.com/bid/92752 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
http://www.securityfocus.com/bid/92752 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
|
| aliases |
CVE-2016-7137, GHSA-69vh-662j-v988, PYSEC-2017-60
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-njnv-5cwt-4ygy |
|
| 20 |
| url |
VCID-pv2n-2y41-pbg5 |
| vulnerability_id |
VCID-pv2n-2y41-pbg5 |
| summary |
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2021-33507, GHSA-35rg-466w-77h3, PYSEC-2021-79
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pv2n-2y41-pbg5 |
|
| 21 |
| url |
VCID-r61f-p8nh-2bax |
| vulnerability_id |
VCID-r61f-p8nh-2bax |
| summary |
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://plone.org/security/hotfix/20210518 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track* |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-19T14:12:55Z/ |
|
|
| url |
https://plone.org/security/hotfix/20210518 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-33926, GHSA-47p5-p3jw-w78w, PYSEC-2023-289
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r61f-p8nh-2bax |
|
| 22 |
| url |
VCID-r874-3h26-j3fp |
| vulnerability_id |
VCID-r874-3h26-j3fp |
| summary |
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.4 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-33508, GHSA-rmpv-rcp6-v8wc, PYSEC-2021-80
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r874-3h26-j3fp |
|
| 23 |
| url |
VCID-s5ab-nud4-5qdg |
| vulnerability_id |
VCID-s5ab-nud4-5qdg |
| summary |
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.10 |
| purl |
pkg:pypi/plone@4.3.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 10 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 11 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 12 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 15 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 16 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 17 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 18 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 19 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 20 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 21 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 22 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 23 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 24 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 25 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 26 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 27 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 28 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 29 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 30 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.10 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.5 |
| purl |
pkg:pypi/plone@5.0.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 10 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 11 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 12 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 15 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 16 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 17 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 18 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 19 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 20 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 21 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 22 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 23 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 24 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 25 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 26 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 27 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 28 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 29 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 30 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 31 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 32 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.5 |
|
| 2 |
| url |
pkg:pypi/plone@5.1a2 |
| purl |
pkg:pypi/plone@5.1a2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 18 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 19 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a2 |
|
|
| aliases |
CVE-2016-4041, GHSA-qqgj-22gr-73vx, PYSEC-2017-55
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-s5ab-nud4-5qdg |
|
| 24 |
| url |
VCID-sa7x-wvn1-skh1 |
| vulnerability_id |
VCID-sa7x-wvn1-skh1 |
| summary |
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
| reference_url |
https://plone.org/download/releases/5.2.3 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://plone.org/download/releases/5.2.3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-3313, GHSA-hprr-4vfq-fcxw, PYSEC-2021-78
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sa7x-wvn1-skh1 |
|
| 25 |
| url |
VCID-sg6k-wdwq-9bgd |
| vulnerability_id |
VCID-sg6k-wdwq-9bgd |
| summary |
z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
|
| aliases |
CVE-2016-7136, GHSA-22jm-p2vv-j2hc, PYSEC-2017-59
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sg6k-wdwq-9bgd |
|
| 26 |
|
| 27 |
| url |
VCID-ugq4-1vzc-6uh5 |
| vulnerability_id |
VCID-ugq4-1vzc-6uh5 |
| summary |
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/advisories/GHSA-p5wr-vp8g-q5p4 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-p5wr-vp8g-q5p4 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
| reference_url |
http://www.securityfocus.com/bid/95679 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
4.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
http://www.securityfocus.com/bid/95679 |
|
| 8 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
| 2 |
| url |
pkg:pypi/plone@5.1b1 |
| purl |
pkg:pypi/plone@5.1b1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 18 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 19 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 20 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 21 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1b1 |
|
|
| aliases |
CVE-2017-5524, GHSA-p5wr-vp8g-q5p4, PYSEC-2017-81
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ugq4-1vzc-6uh5 |
|
| 28 |
| url |
VCID-w2u3-bnqq-mqfz |
| vulnerability_id |
VCID-w2u3-bnqq-mqfz |
| summary |
User information disclosure
A vulnerability allows unauthorized disclosure of registered user information. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.8 |
| purl |
pkg:pypi/plone@4.3.8 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 10 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 11 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 12 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 15 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 16 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 17 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 18 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 19 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 20 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 21 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 22 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 23 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 24 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 25 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 26 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 27 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 28 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 29 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 30 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.8 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.1 |
| purl |
pkg:pypi/plone@5.0.1 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 10 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 11 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 12 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 15 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 16 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 17 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 18 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 19 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 20 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 21 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 22 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 23 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 24 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 25 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 26 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 27 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 28 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 29 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 30 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 31 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 32 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.1 |
|
|
| aliases |
GMS-2015-51
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-w2u3-bnqq-mqfz |
|
| 29 |
| url |
VCID-wage-1bme-bkgb |
| vulnerability_id |
VCID-wage-1bme-bkgb |
| summary |
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) |
| references |
| 0 |
|
| 1 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@5.2.2 |
| purl |
pkg:pypi/plone@5.2.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 1 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 2 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 3 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 4 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 5 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 6 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 7 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 8 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 9 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 10 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 11 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 12 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2 |
|
|
| aliases |
CVE-2020-7939, GHSA-hhmf-7rgg-gcw5, PYSEC-2020-88
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wage-1bme-bkgb |
|
| 30 |
| url |
VCID-y2bq-cb4v-mke6 |
| vulnerability_id |
VCID-y2bq-cb4v-mke6 |
| summary |
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.16 |
| purl |
pkg:pypi/plone@4.3.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 6 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 7 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 19 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16 |
|
| 1 |
| url |
pkg:pypi/plone@5.1.0 |
| purl |
pkg:pypi/plone@5.1.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 8 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 9 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 10 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 11 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 12 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 13 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 14 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 15 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 16 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 17 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0 |
|
|
| aliases |
CVE-2017-1000481, GHSA-8g72-gq68-6gqh, PYSEC-2018-70
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y2bq-cb4v-mke6 |
|
| 31 |
| url |
VCID-yaa8-vy4x-cqbq |
| vulnerability_id |
VCID-yaa8-vy4x-cqbq |
| summary |
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.7 |
| purl |
pkg:pypi/plone@4.3.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 10 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 11 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 12 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 15 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 16 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 17 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 18 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 19 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 20 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 21 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 22 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 23 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 24 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 25 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 26 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 27 |
| vulnerability |
VCID-w2u3-bnqq-mqfz |
|
| 28 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 29 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 30 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 31 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.7 |
|
| 1 |
| url |
pkg:pypi/plone@5.0rc2 |
| purl |
pkg:pypi/plone@5.0rc2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 2 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 3 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 4 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 5 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 6 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 7 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 8 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 9 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 10 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 11 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 12 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 13 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 14 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 15 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 16 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 17 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 18 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 19 |
| vulnerability |
VCID-w2u3-bnqq-mqfz |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0rc2 |
|
|
| aliases |
CVE-2015-7316, GHSA-vf8g-m3vq-6p4p, PYSEC-2017-53
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-yaa8-vy4x-cqbq |
|
| 32 |
| url |
VCID-ymbd-m6tf-5bap |
| vulnerability_id |
VCID-ymbd-m6tf-5bap |
| summary |
Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/plone/Plone |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/plone/Plone |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
| reference_url |
http://www.securityfocus.com/bid/92752 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
http://www.securityfocus.com/bid/92752 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@4.3.12 |
| purl |
pkg:pypi/plone@4.3.12 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5tbn-qmuj-jya9 |
|
| 8 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 9 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 12 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 13 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 14 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 15 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 16 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 17 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 18 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 19 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 20 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 21 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 22 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.12 |
|
| 1 |
| url |
pkg:pypi/plone@5.0.6 |
| purl |
pkg:pypi/plone@5.0.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36rb-6jkw-j7d8 |
|
| 3 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 4 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 5 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 6 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 7 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 8 |
| vulnerability |
VCID-5kaj-zugj-mbh1 |
|
| 9 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 10 |
| vulnerability |
VCID-6898-z4k5-h3b6 |
|
| 11 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 12 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 13 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 14 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 15 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 16 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 17 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 18 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 19 |
| vulnerability |
VCID-m91w-vguw-qkem |
|
| 20 |
| vulnerability |
VCID-njnv-5cwt-4ygy |
|
| 21 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 22 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 23 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 24 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 25 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 26 |
| vulnerability |
VCID-sg6k-wdwq-9bgd |
|
| 27 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 28 |
| vulnerability |
VCID-ugq4-1vzc-6uh5 |
|
| 29 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 30 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 31 |
| vulnerability |
VCID-ymbd-m6tf-5bap |
|
| 32 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.6 |
|
| 2 |
| url |
pkg:pypi/plone@5.0.7 |
| purl |
pkg:pypi/plone@5.0.7 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-2jxf-hfxq-skg7 |
|
| 1 |
| vulnerability |
VCID-311f-xecp-47fm |
|
| 2 |
| vulnerability |
VCID-36xh-ua3s-gyfr |
|
| 3 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 4 |
| vulnerability |
VCID-3s9q-6gvu-qyef |
|
| 5 |
| vulnerability |
VCID-43m1-jkv8-jygp |
|
| 6 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 7 |
| vulnerability |
VCID-5z33-3pqj-gygw |
|
| 8 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 9 |
| vulnerability |
VCID-c3we-w4qc-6fhs |
|
| 10 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 11 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 12 |
| vulnerability |
VCID-fga8-ymex-67fw |
|
| 13 |
| vulnerability |
VCID-gejv-h449-13e4 |
|
| 14 |
| vulnerability |
VCID-gsnt-c1cd-d3bf |
|
| 15 |
| vulnerability |
VCID-jn3b-smfx-87gg |
|
| 16 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 17 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 18 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 19 |
| vulnerability |
VCID-s5ab-nud4-5qdg |
|
| 20 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 21 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
| 22 |
| vulnerability |
VCID-wage-1bme-bkgb |
|
| 23 |
| vulnerability |
VCID-y2bq-cb4v-mke6 |
|
| 24 |
| vulnerability |
VCID-z8kt-tf38-eqgc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.0.7 |
|
|
| aliases |
CVE-2016-7139, GHSA-pp4c-2692-7f37, PYSEC-2017-62
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ymbd-m6tf-5bap |
|
| 33 |
| url |
VCID-z8kt-tf38-eqgc |
| vulnerability_id |
VCID-z8kt-tf38-eqgc |
| summary |
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:pypi/plone@5.2.3 |
| purl |
pkg:pypi/plone@5.2.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-3n34-5rm7-nbcj |
|
| 1 |
| vulnerability |
VCID-5e2c-6mkx-4udu |
|
| 2 |
| vulnerability |
VCID-9ze6-mfrw-ukdv |
|
| 3 |
| vulnerability |
VCID-ccuu-86vs-s3gs |
|
| 4 |
| vulnerability |
VCID-d68e-uehc-nudc |
|
| 5 |
| vulnerability |
VCID-dnu9-u6zt-c7ch |
|
| 6 |
| vulnerability |
VCID-pv2n-2y41-pbg5 |
|
| 7 |
| vulnerability |
VCID-r61f-p8nh-2bax |
|
| 8 |
| vulnerability |
VCID-r874-3h26-j3fp |
|
| 9 |
| vulnerability |
VCID-sa7x-wvn1-skh1 |
|
| 10 |
| vulnerability |
VCID-tfmu-7tad-xbbe |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3 |
|
|
| aliases |
CVE-2020-28735, GHSA-x7wf-5mjc-6x76, PYSEC-2020-247
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z8kt-tf38-eqgc |
|