CVE-2022-24740

Volto (the Plone React frontend) versions 14.0.0-alpha.5 through 15.0.0-alpha.0 are vulnerable to authentication cookie replacement under high server load due to an outdated react-cookie library. This could allow an attacker to gain the other user’s account privileges. A proof of concept does not...

CVE-2022-24740 Improper Authentication in Volto

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...

CVE-2022-24740 Improper Authentication in Volto

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...

Volto 授权问题漏洞

Volto is a ReactJS-based front-end for the Plone content management system. Volto is vulnerable to an authentication vulnerability that could be exploited by attackers to replace its authentication cookies with authentication cookies from other users, effectively giving them control over other...

plone-app-z3cform (>=4.0.0a1 <=4.0.0a10) potentially affected by unknown CVE via plone-app-contenttypes (=2.2.2)

plone-app-contenttypes PYPI version =2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on plone-app-contenttypes and may be impacted: - plone-app-z3cform =4.0.0a1, =4.0.0a10 Source cves: unknown CVE Source advisory: OSV:GHSA-F7QW-5FGJ-247X...

Cross-site Scripting and Open Redirect in plone.app.contenttypes

Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link...

CVE-2022-23599

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscre...

Cross-site Scripting and Open Redirect in Products.CMFPlone

Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link...

GHSA-8W54-22W9-3G8F Cross-site Scripting and Open Redirect in Products.CMFPlone

Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link...

Cross-site Scripting and Open Redirect in Products.ATContentTypes

Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link...

GHSA-G4C2-GHFG-G5RH Cross-site Scripting and Open Redirect in Products.ATContentTypes

Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link...

CVE-2022-23599

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscre...

Cross site scripting

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscre...

PYSEC-2022-21

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscre...

CVE-2022-23599 Cross-site Scripting and Open Redirect in Products.ATContentTypes

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscre...

CVE-2022-23599 Cross-site Scripting and Open Redirect in Products.ATContentTypes

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscre...

CVE-2022-23599

Summary (supported by provided documents): Plone installations using Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross-site scripting and open redirects when a compromised image_view_fullscreen page is cached (e.g., via Varnish). The issue is mitigated by upgrading ...

CVE-2022-23599 Cross-site Scripting and Open Redirect in Products.ATContentTypes

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscre...

PT-2022-16115 · Unknown +2 · Products.Atcontenttypes +2

Name of the Vulnerable Software and Affected Versions: Plone versions 2.1 through 4.3 Products.ATContentTypes versions prior to 3.0.6 Description: The issue concerns reflected cross site scripting and open redirect vulnerabilities. An attacker can exploit these by getting a compromised version of...

Plone 输入验证错误漏洞

Plone is an open source content management system CMS built on the Zope application server. Plone suffers from an input validation error vulnerability that allows an attacker to fetch a compromised version of the imageviewfullscreen page in the cache...