PL
Product
Plone
103
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 15Medium 30Low 0
Watch
Add Plone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-33926 | 8.8 | Feb 17 | An issue in Plone CMS v Affected: 4.3; 4.3.1; 4.3.2; 4.3.3; 4.3.4; 4.3.5; +34 more |
| CVE-2021-32633 | 8.8 | May 21 | Zope is an open-source web application server Affected: through 4.3.20; 5.0 through 5.2.4 |
| CVE-2020-28736 | 8.8 | Dec 30 | Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager… Affected: before 5.2.3 |
| CVE-2020-28735 | 8.8 | Dec 30 | Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role) Affected: before 5.2.3 |
| CVE-2020-28734 | 8.8 | Dec 30 | Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role Affected: before 5.2.3 |
| CVE-2020-7939 | 8.8 | Jan 23 | SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries Affected: 4.0.0 through 5.2.1 |
| CVE-2020-7938 | 8.8 | Jan 23 | plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level Affected: 5.2.0 through 5.2.1 |
| CVE-2015-7293 | 8.8 | Sep 25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +34 more |
| CVE-2024-22889 | 7.5 | Mar 6 | Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request Affected: 6.0.9 |
| CVE-2024-23756 | 7.5 | Feb 8 | The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading… Affected: 5.2.13 |
| CVE-2021-33511 | 7.5 | May 21 | Plone though 5.2.4 allows SSRF via the lxml parser Affected: through 5.2.4 |
| CVE-2020-7940 | 7.5 | Jan 23 | Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking Affected: 4.3.0 through 5.2.0 |
| CVE-2015-7318 | 7.5 | Sep 25 | Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses Affected: 3.3; 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.3.5; +1 more |
| CVE-2016-4041 | 7.3 | Feb 24 | Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified… Affected: 4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2024-0669 | 7.1 | Jan 18 | A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5 Affected: before 6.0.7 |
Showing 15