RHEL 4 / 5 / 6 : JBoss EWP (RHSA-2014:1320)

Updated packages for Red Hat JBoss Enterprise Web Platform 5.2.0 that fix two security issues are now available for Red Hat Enterprise Linux 4, 5, and 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which...

CentOS 5 / 6 : php / php53 (CESA-2014:1326)

Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severi...

RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 5.2.0 (RHSA-2014:1321)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1321 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with...

CentOS 5 : automake (CESA-2014:1243)

An updated automake package that fixes one security issue is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from...

CentOS Update for php53 CESA-2014:1326 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-5496

kupuspellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service ZServer thread lock via a crafted URL...

CVE-2012-5507

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...

CVE-2012-5494

Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...

CVE-2012-5493

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors...

CVE-2012-5497

membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...

CVE-2012-5485

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface...

CVE-2012-5495

CVE-2012-5495 affects Plone where python_scripts.py can allow remote code execution via a crafted URL (related to “go_back”). Affected versions include Plone up to 4.2.3 and 4.3 up to beta 1. Root cause involves Python code execution from an attacker-controlled URL. The vulnerability allows remot...

CVE-2012-5502

CVE-2012-5502: XSS in Plone?safe_html.py (Plone before 4.2.3 and 4.3 before beta 1) allows remote authenticated users with edit permissions to inject arbitrary script/HTML via unspecified vectors. Exact fix version is not specified in the provided documents; references show patches/releases aroun...

CVE-2012-5496

CVE-2012-5496 affects kupu_spellcheck.py in Kupu for Plone before 4.0, where a crafted URL can trigger a denial-of-service by locking the ZServer thread. Descriptions across connected advisories confirm the DoS via crafted URL vulnerability; no exploitation details or affected versions beyond “Pl...

CVE-2012-5502

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5487

The Plone sandbox bypass CVE-2012-5487 affects Plone before 4.2.3 and 4.3 before beta 1, where the sandbox whitelisting function (allowmodule.py) can be bypassed, allowing remote authenticated users with certain privileges to execute arbitrary Python code via importing vectors. The vulnerability ...

CVE-2012-5491

The CVE-2012-5491 entry concerns information disclosure in the Plone ecosystem via z3c.form. Affected software includes Plone versions prior to 4.2.3 and 4.3 prior to beta 1, where an attacker who knows the form location and element id can obtain the default form field values remotely. The underl...

CVE-2012-5506

The CVE-2012-5506 entry affects Plone: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) by issuing an RSS feed request for a folder the user does not have permission to access. Connected advisories corroborate the s...

CVE-2012-5505

Plone vulnerability CVE-2012-5505 affects Plone before 4.2.3 and 4.3 before beta 1, where atat.py allows remote attackers to read private data structures by requesting a view without a name. This is an information disclosure flaw in the view-dispatch path, enabling leakage of private structures w...

CVE-2012-5493

Summary (CVE-2012-5493) : The issue affects Plone prior to 4.2.3 and Plone 4.3 prior to beta 1, where the gtbn.py module allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code through unspecified vectors. The affected component is...