CVE-2012-5502

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5494

Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...

CVE-2012-5495

CVE-2012-5495 affects Plone where python_scripts.py can allow remote code execution via a crafted URL (related to “go_back”). Affected versions include Plone up to 4.2.3 and 4.3 up to beta 1. Root cause involves Python code execution from an attacker-controlled URL. The vulnerability allows remot...

CVE-2012-5487

The Plone sandbox bypass CVE-2012-5487 affects Plone before 4.2.3 and 4.3 before beta 1, where the sandbox whitelisting function (allowmodule.py) can be bypassed, allowing remote authenticated users with certain privileges to execute arbitrary Python code via importing vectors. The vulnerability ...

CVE-2012-5502

CVE-2012-5502: XSS in Plone?safe_html.py (Plone before 4.2.3 and 4.3 before beta 1) allows remote authenticated users with edit permissions to inject arbitrary script/HTML via unspecified vectors. Exact fix version is not specified in the provided documents; references show patches/releases aroun...

CVE-2012-5493

Summary (CVE-2012-5493) : The issue affects Plone prior to 4.2.3 and Plone 4.3 prior to beta 1, where the gtbn.py module allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code through unspecified vectors. The affected component is...

CVE-2012-5497

Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...

CVE-2012-5491

z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...

CVE-2012-5496

CVE-2012-5496 affects kupu_spellcheck.py in Kupu for Plone before 4.0, where a crafted URL can trigger a denial-of-service by locking the ZServer thread. Descriptions across connected advisories confirm the DoS via crafted URL vulnerability; no exploitation details or affected versions beyond “Pl...

CVE-2012-5485

CVE-2012-5485 affects Plone (as part of conga/luci) where registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote code execution via the admin interface. Root cause is improper handling in the RestrictedPython sandbox when processing admin actions, enabling a remote attacke...

CVE-2012-5503

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors...

CVE-2012-5501

Plone vulnerability CVE-2012-5501 affects at_download.py in Plone before 4.2.3 and 4.3 before beta 1, enabling remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL. The connected records consistently describe this exact issue and cite Plone-...

CVE-2012-5504

CVE-2012-5504 affects Plone’s widget_traversal.py, with vulnerable versions: Plone before 4.2.3 and 4.3 before beta1. The issue is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. No exploit details are provided in the ...

CVE-2012-5499

CVE-2012-5499 affects Plone prior to 4.2.3 and 4.3 prior to beta 1. The vulnerability is triggered by a large value in python_scripts.py, related to formatColumns, enabling a remote DoS via memory consumption. Affected component: Plone (within the Python sandbox) as part of luci/conga deployments...

CVE-2012-5498

queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection...

CVE-2012-5498

CVE-2012-5498 affects Plone (the CMS) where queryCatalog.py in Plone versions before 4.2.3 and before beta1 of 4.3 can bypass caching, enabling a remote attacker to cause a denial of service via a crafted request to a collection. The NVD cites a base score of 5.0 (Medium) with network access and ...

CVE-2012-5499

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service memory consumption via a large value, related to formatColumns...

CVE-2012-5490

Plone XSS in kssdevel.py affects Plone before 4.2.3 and 4.3 before beta1, enabling remote script/HTML injection via unspecified vectors. Root cause specifics are not provided in the description. Remediation indicated by connected advisories: apply the Plone security fixes (hotfix/releases around ...

CVE-2012-5490

Cross-site scripting XSS vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5507

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...