PL
Product
Plone
103
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 30Low 0
Watch
Add Plone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-33509 | 9.9 | May 21 | Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script Affected: through 5.2.4 |
| CVE-2020-35190 | 9.8 | Dec 17 | The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user Affected: 4.0.0-alpine before 4.3.18-alpine |
| CVE-2020-7941 | 9.8 | Jan 23 | A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission Affected: 4.3.0 through 5.2.1 |
| CVE-2021-33926 | 8.8 | Feb 17 | An issue in Plone CMS v Affected: 4.3; 4.3.1; 4.3.2; 4.3.3; 4.3.4; 4.3.5; +34 more |
| CVE-2021-32633 | 8.8 | May 21 | Zope is an open-source web application server Affected: through 4.3.20; 5.0 through 5.2.4 |
| CVE-2020-28736 | 8.8 | Dec 30 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager… Affected: before 5.2.3 |
| CVE-2020-28735 | 8.8 | Dec 30 | Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role) Affected: before 5.2.3 |
| CVE-2020-28734 | 8.8 | Dec 30 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role Affected: before 5.2.3 |
| CVE-2020-7939 | 8.8 | Jan 23 | SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries Affected: 4.0.0 through 5.2.1 |
| CVE-2020-7938 | 8.8 | Jan 23 | plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level Affected: 5.2.0 through 5.2.1 |
| CVE-2015-7293 | 8.8 | Sep 25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2024-22889 | 7.5 | Mar 6 | Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request Affected: 6.0.9 |
| CVE-2024-23756 | 7.5 | Feb 8 | The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading… Affected: 5.2.13 |
| CVE-2021-33511 | 7.5 | May 21 | Plone though 5.2.4 allows SSRF via the lxml parser Affected: through 5.2.4 |
| CVE-2020-7940 | 7.5 | Jan 23 | Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking Affected: 4.3.0 through 5.2.0 |
| CVE-2015-7318 | 7.5 | Sep 25 | Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +1 more |
| CVE-2016-4041 | 7.3 | Feb 24 | Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified… Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2024-0669 | 7.1 | Jan 18 | A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5 Affected: before 6.0.7 |
| CVE-2015-7317 | 6.8 | Sep 25 | Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +27 more |
| CVE-2021-21336 | 6.5 | Mar 8 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework Affected: 4.3.0 through 4.3.20; 5.0 through 5.2.4 |
| CVE-2017-1000483 | 6.5 | Jan 3 | Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1 Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2022-23599 | 6.1 | Jan 28 | Products.ATContentTypes are the core content types for Plone 2.1 - 4.3 Affected: before 3.0.6 |
| CVE-2021-33507 | 6.1 | May 21 | Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS Affected: through 4.3.20; 5.0 through 5.2.4 |
| CVE-2020-7936 | 6.1 | Jan 23 | An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly… Affected: 4.0.0 through 5.2.1 |
| CVE-2013-7062 | 6.1 | Jan 2 | Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through… Affected: 3.3.0 through 3.3.6; 4.0.0 through 4.0.9; 4.1.0 through 4.1.6; 4.2.0 through 4.2.7; 4.3.0 through 4.3.2 |
| CVE-2017-1000484 | 6.1 | Jan 3 | By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2017-1000481 | 6.1 | Jan 3 | When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2015-7316 | 6.1 | Sep 25 | Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1 Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7140 | 6.1 | Mar 7 | Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7139 | 6.1 | Mar 7 | Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7138 | 6.1 | Mar 7 | Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7137 | 6.1 | Mar 7 | Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7136 | 6.1 | Mar 7 | z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2016-7147 | 6.1 | Feb 4 | Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers… Affected: 2.5.5; 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; +34 more |
| CVE-2015-7315 | 5.9 | Sep 25 | Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2021-35959 | 5.4 | Jun 30 | In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field Affected: 5.0 through 5.2.4 |
| CVE-2021-33513 | 5.4 | May 21 | Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool Affected: through 5.2.4 |
| CVE-2021-33512 | 5.4 | May 21 | Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document Affected: through 5.2.4 |
| CVE-2021-33508 | 5.4 | May 21 | Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item Affected: through 5.2.4 |
| CVE-2021-3313 | 5.4 | May 20 | Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality Affected: before 5.2.4 |
| CVE-2021-29002 | 5.4 | Mar 24 | A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter Affected: 5.2.3 |
| CVE-2020-7937 | 5.4 | Jan 23 | An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site Affected: 5.0 through 5.2.1 |
| CVE-2017-1000482 | 5.4 | Jan 3 | A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author… Affected: through 5.0.9; 5.1; 5.1; 5.1; 5.1; 5.1; +1 more |
| CVE-2016-4042 | 5.3 | Feb 24 | Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2016-7135 | 4.9 | Mar 7 | Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a Affected: 4.2; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +26 more |
| CVE-2016-4043 | 4.9 | Feb 24 | Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates Affected: 5.0; 5.0; 5.0; 5.0; 5.0.1; 5.0.2; +3 more |
| CVE-2021-33510 | 4.3 | May 21 | Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file Affected: through 5.2.4 |
| CVE-2017-5524 | 4.3 | Mar 23 | Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string… Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2012-6661 | – | Nov 3 | Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5508 | – | Nov 3 | The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |