CVE-2012-5494

Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...

CVE-2012-5491

z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...

CVE-2012-5497

Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...

CVE-2012-5490

Plone XSS in kssdevel.py affects Plone before 4.2.3 and 4.3 before beta1, enabling remote script/HTML injection via unspecified vectors. Root cause specifics are not provided in the description. Remediation indicated by connected advisories: apply the Plone security fixes (hotfix/releases around ...

CVE-2012-5504

CVE-2012-5504 affects Plone’s widget_traversal.py, with vulnerable versions: Plone before 4.2.3 and 4.3 before beta1. The issue is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. No exploit details are provided in the ...

CVE-2012-5485

CVE-2012-5485 affects Plone (as part of conga/luci) where registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote code execution via the admin interface. Root cause is improper handling in the RestrictedPython sandbox when processing admin actions, enabling a remote attacke...

CVE-2012-5499

CVE-2012-5499 affects Plone prior to 4.2.3 and 4.3 prior to beta 1. The vulnerability is triggered by a large value in python_scripts.py, related to formatColumns, enabling a remote DoS via memory consumption. Affected component: Plone (within the Python sandbox) as part of luci/conga deployments...

CVE-2012-5498

CVE-2012-5498 affects Plone (the CMS) where queryCatalog.py in Plone versions before 4.2.3 and before beta1 of 4.3 can bypass caching, enabling a remote attacker to cause a denial of service via a crafted request to a collection. The NVD cites a base score of 5.0 (Medium) with network access and ...

CVE-2012-5499

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service memory consumption via a large value, related to formatColumns...

CVE-2012-5498

queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection...

CVE-2012-5488

CVE-2012-5488 affects Plone components bundled with luci (e.g., Plone versions before 4.2.3 and 4.3 before beta 1). The vulnerability allows remote attackers to execute Python code via a crafted URL, related to createObject in python_scripts.py. Connected advisories confirm a remote code executio...

CVE-2012-5501

Plone vulnerability CVE-2012-5501 affects at_download.py in Plone before 4.2.3 and 4.3 before beta 1, enabling remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL. The connected records consistently describe this exact issue and cite Plone-...

CVE-2012-5503

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors...

CVE-2012-5492

Plone uid_catalog.py vulnerability: affects Plone before 4.2.3 and 4.3 before beta 1; remote attacker can obtain metadata about hidden objects via a crafted URL. Mitigation is to upgrade to Plone 4.2.3+ (or 4.3 beta1+ per advisories).

CVE-2012-5494

Plone contains a Cross‑Site Scripting (XSS) vulnerability (CVE-2012-5494) in python_scripts.py, affecting Plone versions before 4.2.3 and before beta 1 of 4.3. The issue is related to translation handling ("{u,}translate") and allows remote attackers to inject arbitrary web script or HTML via uns...

CVE-2012-6316

CVE-2012-6316 affects the TP-LINK TL-WR841N router (firmware up to 3.13.9 Build 120201 Rel.54965n and earlier). The vulnerability is a Stored XSS in the web interface, exploitable by remote-authenticated administrators through the parameters (1) username or (2) pwd to the page userRpm/NoipDdnsRpm...

CVE-2012-5489

CVE-2012-5489 affects Zope’s App.Undo.UndoSupport.get_request_var_or_attr in Zope versions before 2.12.21 and 3.13.x before 2.13.11, used by Plone before 4.2.3 and 4.3 before beta 1. The root cause is insufficient access control on restricted attributes, allowing remote authenticated users to acc...

CVE-2012-5486

CVE-2012-5486 - HP: ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19 (used in Plone before 4.3 beta 1) allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. Affected components: Zope 2 series up to 2.13.18; Plone deployments including the Plone before...

CVE-2012-5503

Plone contains a vulnerability in ftp.py where remote attackers can read hidden folder contents. Affected versions are Plone before 4.2.3 and 4.3 before beta 1. The description does not specify the exact vectors, root cause details, or practical exploitation steps, and no remediation is provided ...

CVE-2012-5507

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...