Search for packages
| purl | pkg:pypi/plone@4.0a3 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-32633
Aliases: GHSA-5pr9-v234-jw36 |
Path Traversal Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web … |
Vulnerable |
|
GMS-2015-51
|
User information disclosure A vulnerability allows unauthorized disclosure of registered user information. |
Vulnerable Vulnerable |
|
PYSEC-2021-889
Aliases: CVE-2021-29002 GHSA-38g6-x6jv-jwff |
A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. | There are no reported fixed by versions. |
|
PYSEC-2021-84
Aliases: CVE-2021-33512 GHSA-hm2h-f456-6j88 |
Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. |
Vulnerable |
|
PYSEC-2021-85
Aliases: CVE-2021-33513 GHSA-fj67-w3m4-rfmp |
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. |
Vulnerable |
|
PYSEC-2014-66
Aliases: CVE-2013-7061 GHSA-4vr8-r7qr-fpvq PYSEC-2014-68 |
Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search … |
Vulnerable |
|
PYSEC-2020-247
Aliases: CVE-2020-28735 GHSA-x7wf-5mjc-6x76 PYSEC-2026-2881 PYSEC-2026-2884 PYSEC-2026-2887 PYSEC-2026-737 |
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). |
Vulnerable |
|
PYSEC-2014-28
Aliases: CVE-2012-5486 GHSA-77hv-8796-8ccp PYSEC-2014-73 |
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary … |
Vulnerable |
|
PYSEC-2011-22
Aliases: CVE-2011-4462 GHSA-pcwm-8jc3-qxvj |
Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which … |
Vulnerable |
|
PYSEC-2021-83
Aliases: CVE-2021-33511 GHSA-gc9g-67cq-p7v4 |
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, … |
Vulnerable |
|
PYSEC-2021-79
Aliases: CVE-2021-33507 GHSA-35rg-466w-77h3 PYSEC-2026-2961 PYSEC-2026-2967 |
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. |
Vulnerable |
|
PYSEC-2014-31
Aliases: CVE-2012-5489 GHSA-879r-7f3w-8jj3 PYSEC-2014-74 |
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before … |
Vulnerable Vulnerable |
|
PYSEC-2014-45
Aliases: CVE-2012-5503 GHSA-prr5-pfr8-q9f3 |
ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified … |
Vulnerable Vulnerable |
|
PYSEC-2017-81
Aliases: CVE-2017-5524 GHSA-p5wr-vp8g-q5p4 |
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive … |
Vulnerable Vulnerable |
|
PYSEC-2021-82
Aliases: CVE-2021-33510 GHSA-4mg4-wvmx-5332 |
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line … |
Vulnerable |
|
PYSEC-2021-81
Aliases: CVE-2021-33509 GHSA-hm2p-fhwx-9285 |
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in … |
Vulnerable |
|
PYSEC-2018-73
Aliases: CVE-2017-1000484 GHSA-xvwv-6wvx-px9x |
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own … |
Vulnerable |
|
PYSEC-2020-248
Aliases: CVE-2020-28736 GHSA-2c8c-84w2-j38j PYSEC-2026-2879 PYSEC-2026-2882 PYSEC-2026-2885 PYSEC-2026-735 |
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only … |
Vulnerable |
|
PYSEC-2020-246
Aliases: CVE-2020-28734 GHSA-wq6x-g685-w5f2 PYSEC-2026-2880 PYSEC-2026-2883 PYSEC-2026-2886 PYSEC-2026-736 |
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. |
Vulnerable |
|
PYSEC-2011-15
Aliases: CVE-2011-1949 GHSA-h6hq-c896-w882 |
Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to … |
Vulnerable |
|
PYSEC-2021-80
Aliases: CVE-2021-33508 GHSA-rmpv-rcp6-v8wc |
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a … |
Vulnerable |
|
PYSEC-2014-51
Aliases: CVE-2012-6661 GHSA-48vv-2pmq-9fvv PYSEC-2014-76 |
Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number … |
Vulnerable Vulnerable |
|
PYSEC-2011-16
Aliases: CVE-2011-1950 GHSA-2qx8-589j-gcpx PYSEC-2026-2888 |
plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, … |
Vulnerable |
|
PYSEC-2014-65
Aliases: CVE-2013-7060 GHSA-rg52-j87w-pf83 PYSEC-2014-67 |
Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file … |
Vulnerable |
|
PYSEC-2014-49
Aliases: CVE-2012-5507 GHSA-3qpr-7rmg-73v8 PYSEC-2014-75 |
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to … |
Vulnerable Vulnerable |
|
GHSA-5xfx-55x4-j223
Aliases: CVE-2024-0669 |
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious … |
Vulnerable |
|
GHSA-gc9g-67cq-p7v4
Aliases: CVE-2021-33511 |
Server-Side Request Forgery in Plone Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW … | There are no reported fixed by versions. |
|
GHSA-rmpv-rcp6-v8wc
Aliases: CVE-2021-33508 |
Cross-site scripting in Plone Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the … | There are no reported fixed by versions. |
|
GHSA-fj67-w3m4-rfmp
Aliases: CVE-2021-33513 |
Cross-site scripting in Plone Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. | There are no reported fixed by versions. |
|
GHSA-35rg-466w-77h3
Aliases: CVE-2021-33507 |
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 … | There are no reported fixed by versions. |
|
GHSA-4mg4-wvmx-5332
Aliases: CVE-2021-33510 |
Server-Side Request Forgery in Plone Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical … | There are no reported fixed by versions. |
|
GHSA-hm2h-f456-6j88
Aliases: CVE-2021-33512 |
Cross-site scripting in Plone Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML … | There are no reported fixed by versions. |
|
GHSA-h6hq-c896-w882
Aliases: CVE-2011-1949 |
Plone Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows … |
Vulnerable |
|
GHSA-5whw-5cmm-9jw4
Aliases: CVE-2012-5504 |
Plone Cross-site scripting Vulnerability Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows … |
Vulnerable |
|
GHSA-25jh-5h5r-h33m
Aliases: CVE-2012-5493 |
Plone Sandbox Bypass `gtbn.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions … |
Vulnerable |
|
GHSA-56p3-rrp4-2j82
Aliases: CVE-2013-4200 |
Plone Open Redirection vulnerability via next parameter The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through … |
Vulnerable |
|
GHSA-q46g-v7r4-9vhr
Aliases: CVE-2012-5490 |
Plone Cross-site scripting Vulnerability Cross-site scripting (XSS) vulnerability in `kssdevel.py` in Plone before 4.2.3 and 4.3 before beta 1 allows … |
Vulnerable |
|
GHSA-cxw7-85xm-3xrc
Aliases: CVE-2012-5488 |
Plone Code Injection vulnerability python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python … |
Vulnerable |
|
GHSA-pvhv-qwc8-r2pg
Aliases: CVE-2012-5501 |
Plone Arbitrary File Read `at_download.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary … |
Vulnerable |
|
GHSA-qjxf-6pr8-j87v
Aliases: CVE-2013-4198 |
Plone's authenticated users able to alter their password despite of policy definition `mail_password.py` in Plone 2.1 through 4.1, 4.2.x through … | There are no reported fixed by versions. |
|
GHSA-9m4g-f42q-vrrh
Aliases: CVE-2012-5487 |
Plone Sandbox Bypass The sandbox whitelisting function (`allowmodule.py`) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated … |
Vulnerable |
|
GHSA-f8pg-wp5j-rjxx
Aliases: CVE-2012-5491 |
Plone Information Disclosure `z3c.form`, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain … |
Vulnerable |
|
GHSA-wprr-mc54-c62q
Aliases: CVE-2012-5508 |
Exposure of Sensitive Information in Plone The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote … |
Vulnerable |
|
GHSA-hr59-35cr-qf43
Aliases: CVE-2012-5502 |
Plone Cross-site scripting Vulnerability Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows … |
Vulnerable |
|
GHSA-97rj-p794-wq6m
Aliases: CVE-2012-5498 |
Plone denial of service via Caching Bypass queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers … |
Vulnerable |
|
GHSA-6w93-4c4p-xv2x
Aliases: CVE-2012-5492 |
Plone Metadata Disclosure `uid_catalog.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about … |
Vulnerable |
|
GHSA-gx6w-hcw3-5r37
Aliases: CVE-2012-5496 |
Plone DoS via Crafted URL kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of … |
Vulnerable |
|
GHSA-3v28-9jjp-4g5w
Aliases: CVE-2011-0720 |
Plone Privilege Escalation Vulnerability Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, … |
Vulnerable |
|
GHSA-pwpq-632g-h49g
Aliases: CVE-2013-4189 |
Plone Privilege escalation due improper authorization Multiple unspecified vulnerabilities in (1) `dataitems.py`, (2) `get.py`, and (3) `traverseName.py` in Plone 2.1 … | There are no reported fixed by versions. |
|
GHSA-3g6w-4m7x-97v6
Aliases: CVE-2012-5494 |
Plone Cross-site scripting Vulnerability Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows … |
Vulnerable |
|
GHSA-cq5g-924m-7fxh
Aliases: CVE-2012-5505 |
Plone Information Disclosure `atat.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data … |
Vulnerable |
|
GHSA-4vr8-r7qr-fpvq
Aliases: CVE-2013-7061 |
Plone Privilege escalation through exposed underlying API `Products/CMFPlone/CatalogTool.py` in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and … |
Vulnerable |
|
PYSEC-2014-63
Aliases: CVE-2013-4199 GHSA-xfjq-9rxq-ph6m |
(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-62
Aliases: CVE-2013-4198 GHSA-qjxf-6pr8-j87v |
mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-40
Aliases: CVE-2012-5498 GHSA-97rj-p794-wq6m |
queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial … |
Vulnerable Vulnerable |
|
PYSEC-2018-71
Aliases: CVE-2017-1000482 GHSA-859j-668v-mrr6 PYSEC-2026-2962 |
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this … |
Vulnerable Vulnerable |
|
PYSEC-2014-41
Aliases: CVE-2012-5499 GHSA-wrf2-2rch-cmr9 |
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory … |
Vulnerable Vulnerable |
|
PYSEC-2014-30
Aliases: CVE-2012-5488 GHSA-cxw7-85xm-3xrc |
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted … |
Vulnerable Vulnerable |
|
PYSEC-2011-14
Aliases: CVE-2011-1948 GHSA-p7h9-vf92-5fj5 PYSEC-2026-2965 PYSEC-2026-2966 |
Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via … |
Vulnerable |
|
PYSEC-2014-46
Aliases: CVE-2012-5504 GHSA-5whw-5cmm-9jw4 |
Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject … |
Vulnerable Vulnerable |
|
PYSEC-2014-55
Aliases: CVE-2013-4191 GHSA-grwx-4p5v-9g2g |
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-44
Aliases: CVE-2012-5502 GHSA-hr59-35cr-qf43 |
Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with … |
Vulnerable Vulnerable |
|
PYSEC-2017-56
Aliases: CVE-2016-4042 GHSA-v4vj-49m5-wjhw |
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. |
Vulnerable |
|
PYSEC-2014-33
Aliases: CVE-2012-5491 GHSA-f8pg-wp5j-rjxx |
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form … |
Vulnerable Vulnerable |
|
PYSEC-2014-60
Aliases: CVE-2013-4196 GHSA-qphh-5fv5-2mjj |
The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-52
Aliases: CVE-2013-4188 GHSA-w3pw-qxjj-6prr |
traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-59
Aliases: CVE-2013-4195 GHSA-j67j-8hrp-76xm |
Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-53
Aliases: CVE-2013-4189 GHSA-pwpq-632g-h49g |
Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-43
Aliases: CVE-2012-5501 GHSA-pvhv-qwc8-r2pg |
at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) … |
Vulnerable Vulnerable |
|
PYSEC-2014-57
Aliases: CVE-2013-4193 GHSA-6fgf-x7wg-hp8r |
typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2017-51
Aliases: CVE-2015-7293 GHSA-p3qm-44cf-f8qx |
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
Vulnerable |
|
PYSEC-2014-61
Aliases: CVE-2013-4197 GHSA-jjvw-3h9j-p7jf |
member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2021-78
Aliases: CVE-2021-3313 GHSA-hprr-4vfq-fcxw |
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file … |
Vulnerable |
|
PYSEC-2011-13
Aliases: CVE-2011-0720 GHSA-3v28-9jjp-4g5w |
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to … |
Vulnerable |
|
PYSEC-2017-64
Aliases: CVE-2016-7147 GHSA-84jm-cpc5-c7g7 |
Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and … |
Vulnerable Vulnerable |
|
PYSEC-2014-54
Aliases: CVE-2013-4190 GHSA-89rq-27xp-vgv7 |
Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-34
Aliases: CVE-2012-5492 GHSA-6w93-4c4p-xv2x |
uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via … |
Vulnerable Vulnerable |
|
PYSEC-2014-50
Aliases: CVE-2012-5508 GHSA-wprr-mc54-c62q |
The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and … |
Vulnerable Vulnerable |
|
PYSEC-2014-27
Aliases: CVE-2012-5485 GHSA-7hxc-mwx7-5hmc |
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, … |
Vulnerable Vulnerable |
|
PYSEC-2014-58
Aliases: CVE-2013-4194 GHSA-mm32-jw73-9227 |
The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-35
Aliases: CVE-2012-5493 GHSA-25jh-5h5r-h33m |
gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the … |
Vulnerable Vulnerable |
|
PYSEC-2018-70
Aliases: CVE-2017-1000481 GHSA-8g72-gq68-6gqh PYSEC-2026-2963 |
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a … |
Vulnerable Vulnerable |
|
PYSEC-2014-47
Aliases: CVE-2012-5505 GHSA-cq5g-924m-7fxh |
atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a … |
Vulnerable Vulnerable |
|
PYSEC-2014-39
Aliases: CVE-2012-5497 GHSA-683w-84m7-p8pw |
membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a … |
Vulnerable Vulnerable |
|
PYSEC-2018-72
Aliases: CVE-2017-1000483 GHSA-qc57-h2f7-p4hx |
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the … |
Vulnerable Vulnerable |
|
PYSEC-2014-42
Aliases: CVE-2012-5500 GHSA-2q75-f7cp-w86q |
The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change … |
Vulnerable Vulnerable |
|
PYSEC-2014-37
Aliases: CVE-2012-5495 GHSA-w6pw-5gh5-4952 |
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted … |
Vulnerable Vulnerable |
|
PYSEC-2014-32
Aliases: CVE-2012-5490 GHSA-q46g-v7r4-9vhr |
Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject … |
Vulnerable Vulnerable |
|
PYSEC-2014-48
Aliases: CVE-2012-5506 GHSA-79hj-474h-v4xv |
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite … |
Vulnerable Vulnerable |
|
PYSEC-2014-36
Aliases: CVE-2012-5494 GHSA-3g6w-4m7x-97v6 |
Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject … |
Vulnerable Vulnerable |
|
PYSEC-2014-29
Aliases: CVE-2012-5487 GHSA-9m4g-f42q-vrrh |
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain … |
Vulnerable Vulnerable |
|
PYSEC-2014-64
Aliases: CVE-2013-4200 GHSA-56p3-rrp4-2j82 |
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2014-56
Aliases: CVE-2013-4192 GHSA-f5h9-3hpf-9j8m |
sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2026-733
Aliases: CVE-2006-1711 GHSA-jcwh-rj6j-vm75 |
Plone allows remote users to modify arbitrary portraits Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) … | There are no reported fixed by versions. |
|
PYSEC-2026-1798
Aliases: CVE-2024-22889 GHSA-xg5p-8wg5-rhxm |
Phone information disclosure vulnerability Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all … | There are no reported fixed by versions. |
|
PYSEC-2026-1797
Aliases: CVE-2024-0669 GHSA-5xfx-55x4-j223 |
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious … |
Vulnerable |
|
GHSA-xvwv-6wvx-px9x
Aliases: CVE-2017-1000484 |
Plone Open Redirect By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you … |
Vulnerable Vulnerable |
|
GHSA-chvw-gjxf-f8mc
Aliases: CVE-2016-7140 |
Plone vulnerable to Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x … |
Vulnerable Vulnerable |
|
GHSA-8g72-gq68-6gqh
Aliases: CVE-2017-1000481 |
Products.CMFPlone Open Redirect Vulnerability When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the … |
Vulnerable Vulnerable |
|
GHSA-qc57-h2f7-p4hx
Aliases: CVE-2017-1000483 |
Plone Unauthorized Access Vulnerability Accessing private content via `str.format` in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an … |
Vulnerable Vulnerable |
|
GHSA-v4vj-49m5-wjhw
Aliases: CVE-2016-4042 |
Plone vulnerable to unauthorized disclosure of site content Plone versions 3.3 before 4.3.10 and 5.x before 5.0.5 allow remote attackers … |
Vulnerable Vulnerable |
|
GHSA-pp4c-2692-7f37
Aliases: CVE-2016-7139 |
Plone Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, … |
Vulnerable Vulnerable |
|
GHSA-859j-668v-mrr6
Aliases: CVE-2017-1000482 |
Products.CMFPlone XSS in profile home_page property A member of the Plone site could set javascript in the `home_page` property of … |
Vulnerable Vulnerable |
|
GHSA-qqgj-22gr-73vx
Aliases: CVE-2016-4041 |
Plone vulnerable to privilege escalation in WebDAV Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV … |
Vulnerable Vulnerable |
|
GHSA-3qpr-7rmg-73v8
Aliases: CVE-2012-5507 |
Plone and Zope2 affected by Race Condition AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-48vv-2pmq-9fvv
Aliases: CVE-2012-6661 |
Plone and Zope2 do not reseed pseudo-random number generator Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-879r-7f3w-8jj3
Aliases: CVE-2012-5489 |
Plone and Zope2 vulnerable to unauthorized access to restricted attributes The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-77hv-8796-8ccp
Aliases: CVE-2012-5486 |
HTTP header injection in Plone and Zope2 ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-mm32-jw73-9227
Aliases: CVE-2013-4194 |
Plone is vulnerable to File System Path Exposure The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, … |
Vulnerable Vulnerable |
|
GHSA-xfjq-9rxq-ph6m
Aliases: CVE-2013-4199 |
Plone Denial of Service vulnerability via decompressing large zip archives (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, … |
Vulnerable Vulnerable |
|
GHSA-jjvw-3h9j-p7jf
Aliases: CVE-2013-4197 |
Plone Improper Access Control Vulnerability member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote … |
Vulnerable Vulnerable |
|
GHSA-f5h9-3hpf-9j8m
Aliases: CVE-2013-4192 |
Plone is vulnerable to email spoofing sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows … |
Vulnerable Vulnerable |
|
GHSA-89rq-27xp-vgv7
Aliases: CVE-2013-4190 |
Plone vulnerable to cross-site scripting Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone … |
Vulnerable Vulnerable |
|
GHSA-6fgf-x7wg-hp8r
Aliases: CVE-2013-4193 |
Plone Unrestricted Filed Manipulation vulnerability via content edit forms typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x … |
Vulnerable Vulnerable |
|
GHSA-qphh-5fv5-2mjj
Aliases: CVE-2013-4196 |
Plone is vulnerable to information exposure via the object manager implementation The object manager implementation (objectmanager.py) in Plone 2.1 through … |
Vulnerable Vulnerable |
|
GHSA-grwx-4p5v-9g2g
Aliases: CVE-2013-4191 |
Plone is vulnerable to Information Exposure when generating zip archives zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and … |
Vulnerable Vulnerable |
|
GHSA-j67j-8hrp-76xm
Aliases: CVE-2013-4195 |
Plone Multiple open redirect vulnerabilities Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 … |
Vulnerable Vulnerable |
|
GHSA-984m-rj28-8c6x
Aliases: CVE-2015-7315 |
Plone unauthorized member addition vulnerability Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through … | There are no reported fixed by versions. |
|
GHSA-w3pw-qxjj-6prr
Aliases: CVE-2013-4188 |
Plone Authenticated Denial of Service vulnerability traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows … |
Vulnerable Vulnerable |