PL
Product
Plone
103
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 30Low 0
Watch
Add Plone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-5500 | – | Nov 3 | The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5507 | – | Sep 30 | AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5506 | – | Sep 30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5505 | – | Sep 30 | atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5504 | – | Sep 30 | Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5503 | – | Sep 30 | ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5502 | – | Sep 30 | Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5501 | – | Sep 30 | at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5499 | – | Sep 30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5498 | – | Sep 30 | queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5497 | – | Sep 30 | membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5496 | – | Sep 30 | kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL Affected: through 3.3.5; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5495 | – | Sep 30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back." Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5494 | – | Sep 30 | Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5493 | – | Sep 30 | gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5492 | – | Sep 30 | uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5491 | – | Sep 30 | z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5490 | – | Sep 30 | Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5489 | – | Sep 30 | The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5488 | – | Sep 30 | python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5487 | – | Sep 30 | The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5486 | – | Sep 30 | ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF)… Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2012-5485 | – | Sep 30 | registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface Affected: through 4.2.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2013-7061 | – | May 2 | Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +27 more |
| CVE-2013-7060 | – | May 2 | Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified… Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +27 more |
| CVE-2013-4198 | – | Mar 11 | mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.5; +34 more |
| CVE-2013-4199 | – | Mar 11 | (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service… Affected: 4.2; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +34 more |
| CVE-2013-4197 | – | Mar 11 | member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via… Affected: 4.2; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +34 more |
| CVE-2013-4196 | – | Mar 11 | The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods,… Affected: 4.3; 4.3.1; 2.1; 2.1.1; 2.1.2; 2.1.3; +34 more |
| CVE-2013-4195 | – | Mar 11 | Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.5; +34 more |
| CVE-2013-4194 | – | Mar 11 | The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted… Affected: 4.3; 4.3.1; 4.2; 4.2.1; 4.2.2; 4.2.3; +34 more |
| CVE-2013-4193 | – | Mar 11 | typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.5; +34 more |
| CVE-2013-4192 | – | Mar 11 | sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.5; +34 more |
| CVE-2013-4191 | – | Mar 11 | zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows… Affected: 4.3; 4.3.1; 4.2; 4.2.1; 4.2.2; 4.2.3; +34 more |
| CVE-2013-4189 | – | Mar 11 | Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.5; +34 more |
| CVE-2013-4190 | – | Mar 11 | Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1… Affected: 4.2; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +34 more |
| CVE-2013-4188 | – | Mar 11 | traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite… Affected: 4.3; 4.3.1; 2.1; 2.1.1; 2.1.2; 2.1.3; +34 more |
| CVE-2013-4200 | – | Jan 21 | The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 3.0; +34 more |
| CVE-2011-4462 | – | Dec 30 | Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a… Affected: through 4.1.3; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2011-4030 | – | Oct 10 | The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote… Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +8 more |
| CVE-2011-3587 | – | Oct 10 | Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via… Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +8 more |
| CVE-2011-1340 | – | Aug 5 | Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 2.5.2; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +15 more |
| CVE-2011-2528 | – | Jul 19 | Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows… Affected: 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +30 more |
| CVE-2011-1950 | – | Jun 6 | plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June… Affected: 4.0; 4.1 |
| CVE-2011-1949 | – | Jun 6 | Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.5; +34 more |
| CVE-2011-1948 | – | Jun 6 | Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL Affected: through 4.1; 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; +34 more |
| CVE-2011-0720 | – | Feb 3 | Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create… Affected: 2.5; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +26 more |
| CVE-2010-2422 | – | Jun 24 | Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.5; +30 more |
| CVE-2008-4571 | – | Oct 15 | Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field… Affected: through 3.0.3; 2.0.5; 2.1.2; 2.5; 2.5.1; 2.5.1_rc; +5 more |
| CVE-2007-5741 | – | Nov 7 | Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or… Affected: 2.5; 2.5.1; 2.5.1_rc; 2.5.4; 2.5_beta1; 3.0; +2 more |