{"url":"http://public2.vulnerablecode.io/api/packages/9713?format=json","purl":"pkg:pypi/plone@5.1a1","type":"pypi","namespace":"","name":"plone","version":"5.1a1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"5.2.5","latest_non_vulnerable_version":"6.0.7","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35823?format=json","vulnerability_id":"VCID-29gf-82fr-k3h8","summary":"In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.","references":[{"reference_url":"https://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/06/30/2","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/06/30/2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-35959","PYSEC-2021-110"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-29gf-82fr-k3h8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35163?format=json","vulnerability_id":"VCID-5ry7-xy6b-5fag","summary":"Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.","references":[{"reference_url":"https://github.com/plone/Plone","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Plone"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-72.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-72.yaml"},{"reference_url":"https://plone.org/security/hotfix/20171128/sandbox-escape","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20171128/sandbox-escape"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000483","reference_id":"CVE-2017-1000483","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000483"},{"reference_url":"https://github.com/advisories/GHSA-qc57-h2f7-p4hx","reference_id":"GHSA-qc57-h2f7-p4hx","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-qc57-h2f7-p4hx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/10591?format=json","purl":"pkg:pypi/plone@5.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0"}],"aliases":["CVE-2017-1000483","GHSA-qc57-h2f7-p4hx","PYSEC-2018-72"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5ry7-xy6b-5fag"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35042?format=json","vulnerability_id":"VCID-6568-4ert-1bau","summary":"Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.","references":[{"reference_url":"https://github.com/advisories/GHSA-p5wr-vp8g-q5p4","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-p5wr-vp8g-q5p4"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/a7d47692058e10ce89968e7ca4dacbdf44fcad4f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/a7d47692058e10ce89968e7ca4dacbdf44fcad4f"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/1912","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/1912"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-81.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-81.yaml"},{"reference_url":"https://plone.org/security/hotfix/20170117/sandbox-escape","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20170117/sandbox-escape"},{"reference_url":"http://www.openwall.com/lists/oss-security/2017/01/18/6","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2017/01/18/6"},{"reference_url":"http://www.securityfocus.com/bid/95679","reference_id":"","reference_type":"","scores":[],"url":"http://www.securityfocus.com/bid/95679"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5524","reference_id":"CVE-2017-5524","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5524"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/10585?format=json","purl":"pkg:pypi/plone@5.1b1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-5ry7-xy6b-5fag"},{"vulnerability":"VCID-69ps-uetw-y3gf"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-dg61-tw4u-dbcc"},{"vulnerability":"VCID-edq7-7ncc-mbfx"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1b1"}],"aliases":["CVE-2017-5524","GHSA-p5wr-vp8g-q5p4","PYSEC-2017-81"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6568-4ert-1bau"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35162?format=json","vulnerability_id":"VCID-69ps-uetw-y3gf","summary":"A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.","references":[{"reference_url":"https://github.com/plone/Products.CMFPlone","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373"},{"reference_url":"https://github.com/plone/Products.CMFPlone/issues/2232","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/issues/2232"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2233","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2233"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2234","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2234"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2235","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2235"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2236","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2236"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-71.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-71.yaml"},{"reference_url":"https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000482","reference_id":"CVE-2017-1000482","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000482"},{"reference_url":"https://github.com/advisories/GHSA-859j-668v-mrr6","reference_id":"GHSA-859j-668v-mrr6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-859j-668v-mrr6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/10591?format=json","purl":"pkg:pypi/plone@5.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0"}],"aliases":["CVE-2017-1000482","GHSA-859j-668v-mrr6","PYSEC-2018-71"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-69ps-uetw-y3gf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35702?format=json","vulnerability_id":"VCID-8rp3-p3qe-x7ej","summary":"Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).","references":[{"reference_url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt","reference_id":"","reference_type":"","scores":[],"url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt"},{"reference_url":"https://github.com/advisories/GHSA-2c8c-84w2-j38j","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-2c8c-84w2-j38j"},{"reference_url":"https://github.com/plone/Products.CMFPlone/issues/3209","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/issues/3209"},{"reference_url":"https://www.misakikata.com/codes/plone/python-en.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.misakikata.com/codes/plone/python-en.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19507?format=json","purl":"pkg:pypi/plone@5.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3"}],"aliases":["CVE-2020-28736","GHSA-2c8c-84w2-j38j","PYSEC-2020-248"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8rp3-p3qe-x7ej"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35492?format=json","vulnerability_id":"VCID-8wkk-84ky-17ak","summary":"Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.","references":[{"reference_url":"https://plone.org/security/hotfix/20200121","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121"},{"reference_url":"https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked"},{"reference_url":"https://www.openwall.com/lists/oss-security/2020/01/22/1","reference_id":"","reference_type":"","scores":[],"url":"https://www.openwall.com/lists/oss-security/2020/01/22/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2020/01/24/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2020/01/24/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14880?format=json","purl":"pkg:pypi/plone@5.2.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8t99-yuxa-ekhm"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.1"}],"aliases":["CVE-2020-7940","PYSEC-2020-89"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8wkk-84ky-17ak"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35493?format=json","vulnerability_id":"VCID-951j-w95x-83g8","summary":"An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.","references":[{"reference_url":"https://plone.org/security/hotfix/20200121","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121"},{"reference_url":"https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher"},{"reference_url":"https://www.openwall.com/lists/oss-security/2020/01/22/1","reference_id":"","reference_type":"","scores":[],"url":"https://www.openwall.com/lists/oss-security/2020/01/22/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2020/01/24/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2020/01/24/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14881?format=json","purl":"pkg:pypi/plone@5.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2"}],"aliases":["CVE-2020-7937","PYSEC-2020-86"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-951j-w95x-83g8"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35491?format=json","vulnerability_id":"VCID-9gu8-dgkr-sua3","summary":"An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.","references":[{"reference_url":"https://plone.org/security/hotfix/20200121","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121"},{"reference_url":"https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places"},{"reference_url":"https://www.openwall.com/lists/oss-security/2020/01/22/1","reference_id":"","reference_type":"","scores":[],"url":"https://www.openwall.com/lists/oss-security/2020/01/22/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2020/01/24/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2020/01/24/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14881?format=json","purl":"pkg:pypi/plone@5.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2"}],"aliases":["CVE-2020-7936","PYSEC-2020-85"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9gu8-dgkr-sua3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35806?format=json","vulnerability_id":"VCID-ax8a-2g7j-6ya2","summary":"Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.","references":[{"reference_url":"https://github.com/advisories/GHSA-fj67-w3m4-rfmp","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-fj67-w3m4-rfmp"},{"reference_url":"https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33513","GHSA-fj67-w3m4-rfmp","PYSEC-2021-85"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ax8a-2g7j-6ya2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35798?format=json","vulnerability_id":"VCID-basq-jjsf-3fbd","summary":"Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.","references":[{"reference_url":"https://plone.org/download/releases/5.2.3","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/download/releases/5.2.3"},{"reference_url":"https://plone.org/security/hotfix/20210518","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518"},{"reference_url":"https://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt","reference_id":"","reference_type":"","scores":[],"url":"https://www.compass-security.com/fileadmin/Research/Advisories/2021-07_CSNC-2021-013_XSS_in_Plone_CMS.txt"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/21990?format=json","purl":"pkg:pypi/plone@5.2.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.4"}],"aliases":["CVE-2021-3313","PYSEC-2021-78"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-basq-jjsf-3fbd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35489?format=json","vulnerability_id":"VCID-bmwk-nutp-r3fs","summary":"SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)","references":[{"reference_url":"https://plone.org/security/hotfix/20200121","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121"},{"reference_url":"https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects"},{"reference_url":"https://www.openwall.com/lists/oss-security/2020/01/22/1","reference_id":"","reference_type":"","scores":[],"url":"https://www.openwall.com/lists/oss-security/2020/01/22/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2020/01/24/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2020/01/24/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14881?format=json","purl":"pkg:pypi/plone@5.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2"}],"aliases":["CVE-2020-7939","PYSEC-2020-88"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bmwk-nutp-r3fs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35801?format=json","vulnerability_id":"VCID-d42u-s7za-a3ad","summary":"Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.","references":[{"reference_url":"https://github.com/advisories/GHSA-gc9g-67cq-p7v4","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-gc9g-67cq-p7v4"},{"reference_url":"https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33511","GHSA-gc9g-67cq-p7v4","PYSEC-2021-83"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-d42u-s7za-a3ad"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35161?format=json","vulnerability_id":"VCID-dg61-tw4u-dbcc","summary":"When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.","references":[{"reference_url":"https://github.com/plone/Products.CMFPlone","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8"},{"reference_url":"https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373"},{"reference_url":"https://github.com/plone/Products.CMFPlone/issues/2232","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/issues/2232"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2233","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2233"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2234","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2234"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2235","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2235"},{"reference_url":"https://github.com/plone/Products.CMFPlone/pull/2236","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/pull/2236"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-70.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-70.yaml"},{"reference_url":"https://plone.org/security/hotfix/20171128/open-redirection-on-login-form","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20171128/open-redirection-on-login-form"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000481","reference_id":"CVE-2017-1000481","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000481"},{"reference_url":"https://github.com/advisories/GHSA-8g72-gq68-6gqh","reference_id":"GHSA-8g72-gq68-6gqh","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-8g72-gq68-6gqh"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/10591?format=json","purl":"pkg:pypi/plone@5.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0"}],"aliases":["CVE-2017-1000481","GHSA-8g72-gq68-6gqh","PYSEC-2018-70"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dg61-tw4u-dbcc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35164?format=json","vulnerability_id":"VCID-edq7-7ncc-mbfx","summary":"By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)","references":[{"reference_url":"https://github.com/advisories/GHSA-xvwv-6wvx-px9x","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-xvwv-6wvx-px9x"},{"reference_url":"https://github.com/plone/Plone","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Plone"},{"reference_url":"https://github.com/plone/Products.CMFPlone/issues/2232","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/issues/2232"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml"},{"reference_url":"https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000484","reference_id":"CVE-2017-1000484","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000484"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/10591?format=json","purl":"pkg:pypi/plone@5.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0"}],"aliases":["CVE-2017-1000484","GHSA-xvwv-6wvx-px9x","PYSEC-2018-73"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-edq7-7ncc-mbfx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35800?format=json","vulnerability_id":"VCID-eu4z-htaq-c3d6","summary":"Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.","references":[{"reference_url":"https://github.com/advisories/GHSA-4mg4-wvmx-5332","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-4mg4-wvmx-5332"},{"reference_url":"https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33510","GHSA-4mg4-wvmx-5332","PYSEC-2021-82"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-eu4z-htaq-c3d6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35701?format=json","vulnerability_id":"VCID-exan-4j3e-2qeh","summary":"Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.","references":[{"reference_url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt","reference_id":"","reference_type":"","scores":[],"url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt"},{"reference_url":"https://github.com/advisories/GHSA-wq6x-g685-w5f2","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-wq6x-g685-w5f2"},{"reference_url":"https://github.com/plone/Products.CMFPlone/issues/3209","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/issues/3209"},{"reference_url":"https://www.misakikata.com/codes/plone/python-en.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.misakikata.com/codes/plone/python-en.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19507?format=json","purl":"pkg:pypi/plone@5.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3"}],"aliases":["CVE-2020-28734","GHSA-wq6x-g685-w5f2","PYSEC-2020-246"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-exan-4j3e-2qeh"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35700?format=json","vulnerability_id":"VCID-fdpc-runu-ekah","summary":"Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).","references":[{"reference_url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt","reference_id":"","reference_type":"","scores":[],"url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt"},{"reference_url":"https://github.com/advisories/GHSA-x7wf-5mjc-6x76","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-x7wf-5mjc-6x76"},{"reference_url":"https://github.com/plone/Products.CMFPlone/issues/3209","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Products.CMFPlone/issues/3209"},{"reference_url":"https://www.misakikata.com/codes/plone/python-en.html","reference_id":"","reference_type":"","scores":[],"url":"https://www.misakikata.com/codes/plone/python-en.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/19507?format=json","purl":"pkg:pypi/plone@5.2.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.3"}],"aliases":["CVE-2020-28735","GHSA-x7wf-5mjc-6x76","PYSEC-2020-247"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fdpc-runu-ekah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35490?format=json","vulnerability_id":"VCID-j8fv-uhxw-jkcw","summary":"A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.","references":[{"reference_url":"https://plone.org/security/hotfix/20200121","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121"},{"reference_url":"https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content"},{"reference_url":"https://www.openwall.com/lists/oss-security/2020/01/22/1","reference_id":"","reference_type":"","scores":[],"url":"https://www.openwall.com/lists/oss-security/2020/01/22/1"},{"reference_url":"http://www.openwall.com/lists/oss-security/2020/01/24/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2020/01/24/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/14881?format=json","purl":"pkg:pypi/plone@5.2.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.2"}],"aliases":["CVE-2020-7941","PYSEC-2020-90"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j8fv-uhxw-jkcw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35028?format=json","vulnerability_id":"VCID-jvvz-bafs-t7gc","summary":"Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.","references":[{"reference_url":"https://plone.org/security/hotfix/20160419/bypass-restricted-python","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20160419/bypass-restricted-python"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/04/20/3","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2016/04/20/3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9714?format=json","purl":"pkg:pypi/plone@5.1a2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-5ry7-xy6b-5fag"},{"vulnerability":"VCID-69ps-uetw-y3gf"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-dg61-tw4u-dbcc"},{"vulnerability":"VCID-edq7-7ncc-mbfx"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a2"}],"aliases":["CVE-2016-4043","PYSEC-2017-57"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jvvz-bafs-t7gc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35805?format=json","vulnerability_id":"VCID-p71t-er3d-9fdn","summary":"Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.","references":[{"reference_url":"https://github.com/advisories/GHSA-hm2h-f456-6j88","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hm2h-f456-6j88"},{"reference_url":"https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33512","GHSA-hm2h-f456-6j88","PYSEC-2021-84"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p71t-er3d-9fdn"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35030?format=json","vulnerability_id":"VCID-pzke-4by2-w3hk","summary":"Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.","references":[{"reference_url":"https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/04/20/2","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2016/04/20/2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9714?format=json","purl":"pkg:pypi/plone@5.1a2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-5ry7-xy6b-5fag"},{"vulnerability":"VCID-69ps-uetw-y3gf"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-dg61-tw4u-dbcc"},{"vulnerability":"VCID-edq7-7ncc-mbfx"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a2"}],"aliases":["CVE-2016-4042","PYSEC-2017-56"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pzke-4by2-w3hk"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35804?format=json","vulnerability_id":"VCID-q7nt-b3s9-9kf6","summary":"Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.","references":[{"reference_url":"https://github.com/advisories/GHSA-35rg-466w-77h3","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-35rg-466w-77h3"},{"reference_url":"https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33507","GHSA-35rg-466w-77h3","PYSEC-2021-79"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-q7nt-b3s9-9kf6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35802?format=json","vulnerability_id":"VCID-r52t-hx1j-ufa1","summary":"Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.","references":[{"reference_url":"https://github.com/advisories/GHSA-rmpv-rcp6-v8wc","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-rmpv-rcp6-v8wc"},{"reference_url":"https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33508","GHSA-rmpv-rcp6-v8wc","PYSEC-2021-80"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r52t-hx1j-ufa1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35803?format=json","vulnerability_id":"VCID-x2xm-hpc2-uubq","summary":"Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.","references":[{"reference_url":"https://github.com/advisories/GHSA-hm2p-fhwx-9285","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hm2p-fhwx-9285"},{"reference_url":"https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script"},{"reference_url":"http://www.openwall.com/lists/oss-security/2021/05/22/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33509","GHSA-hm2p-fhwx-9285","PYSEC-2021-81"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-x2xm-hpc2-uubq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/36381?format=json","vulnerability_id":"VCID-z4jt-v88h-77er","summary":"An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.","references":[{"reference_url":"https://github.com/plone/Plone","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/plone/Plone"},{"reference_url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2023-289.yaml","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2023-289.yaml"},{"reference_url":"https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf"},{"reference_url":"https://plone.org/security/hotfix/20210518","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://plone.org/security/hotfix/20210518"},{"reference_url":"https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"url":"https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33926","reference_id":"CVE-2021-33926","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33926"},{"reference_url":"https://github.com/advisories/GHSA-47p5-p3jw-w78w","reference_id":"GHSA-47p5-p3jw-w78w","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-47p5-p3jw-w78w"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/22026?format=json","purl":"pkg:pypi/plone@5.2.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.2.5"}],"aliases":["CVE-2021-33926","GHSA-47p5-p3jw-w78w","PYSEC-2023-289"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z4jt-v88h-77er"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35029?format=json","vulnerability_id":"VCID-zwnj-revc-vbd6","summary":"Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.","references":[{"reference_url":"https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav","reference_id":"","reference_type":"","scores":[],"url":"https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/04/20/1","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2016/04/20/1"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/9714?format=json","purl":"pkg:pypi/plone@5.1a2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-29gf-82fr-k3h8"},{"vulnerability":"VCID-5ry7-xy6b-5fag"},{"vulnerability":"VCID-69ps-uetw-y3gf"},{"vulnerability":"VCID-8rp3-p3qe-x7ej"},{"vulnerability":"VCID-8wkk-84ky-17ak"},{"vulnerability":"VCID-951j-w95x-83g8"},{"vulnerability":"VCID-9gu8-dgkr-sua3"},{"vulnerability":"VCID-ax8a-2g7j-6ya2"},{"vulnerability":"VCID-basq-jjsf-3fbd"},{"vulnerability":"VCID-bmwk-nutp-r3fs"},{"vulnerability":"VCID-d42u-s7za-a3ad"},{"vulnerability":"VCID-dg61-tw4u-dbcc"},{"vulnerability":"VCID-edq7-7ncc-mbfx"},{"vulnerability":"VCID-eu4z-htaq-c3d6"},{"vulnerability":"VCID-exan-4j3e-2qeh"},{"vulnerability":"VCID-fdpc-runu-ekah"},{"vulnerability":"VCID-j8fv-uhxw-jkcw"},{"vulnerability":"VCID-p71t-er3d-9fdn"},{"vulnerability":"VCID-q7nt-b3s9-9kf6"},{"vulnerability":"VCID-r52t-hx1j-ufa1"},{"vulnerability":"VCID-x2xm-hpc2-uubq"},{"vulnerability":"VCID-z4jt-v88h-77er"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a2"}],"aliases":["CVE-2016-4041","PYSEC-2017-55"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zwnj-revc-vbd6"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1a1"}