1428 matches found
Plone 跨站脚本漏洞
Plone is an open source content management system CMS built on the Zope application server. Plone suffers from a cross-site scripting vulnerability in versions 5.0 through 5.2.4 that stems from the fact that if a contributor creates a folder with a SCRIPT tag in the description field, the editor ...
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...
GHSA-35RG-466W-77H3 Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...
Server-Side Request Forgery in Plone
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...
GHSA-GC9G-67CQ-P7V4 Server-Side Request Forgery in Plone
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...
Server-Side Request Forgery in Plone
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...
GHSA-4MG4-WVMX-5332 Server-Side Request Forgery in Plone
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...
Incorrect Permission Assignment for Critical Resource in Plone
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...
GHSA-HM2P-FHWX-9285 Incorrect Permission Assignment for Critical Resource in Plone
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...
Cross-site scripting in Plone
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...
GHSA-RMPV-RCP6-V8WC Cross-site scripting in Plone
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...
Cross-site scripting in Plone
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
GHSA-HM2H-F456-6J88 Cross-site scripting in Plone
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
Cross-site scripting in Plone
Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...
GHSA-FJ67-W3M4-RFMP Cross-site scripting in Plone
Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...
Plone CMS <= 5.2.4 Multiple Vulnerabilities
Plone CMS is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Cross-Site Scripting (XSS)
plone is vulnerable to cross-site scripting. The vulnerability exists due to the mishandling of the full name during rendering of the ownership tab of a content item...
Cross-Site Scripting (XSS)
plone is vulnerable to cross-site scripting. The package fails to sanitize the user fullname field allowing attackers to execute arbitrary JavaScript in a victim's browser...
Plone server-side request forgery vulnerability
Plone is the Plone Foundation's open source content management system running on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An attacker can exploit this vulnerability to initiate a server-side request using the lxml parser...