1428 matches found
CVE-2016-7135
CVE-2016-7135: Directory traversal in Plone CMS (versions 5.x up to 5.0.6 and 4.2.x up to 4.3.11) allows remote administrators to read arbitrary files via a .. in the path parameter of a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions. Root cause is unsanit...
CVE-2016-7138
Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...
CVE-2016-7139
Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...
CVE-2016-7139
CVE-2016-7139 is a cross-site scripting (XSS) vulnerability in Plone CMS, affecting Plone 5.x up to 5.0.6, 4.x up to 4.3.11, and 3.3.x up to 3.3.6. The flaw is described as an XSS in an unspecified page template, allowing remote attackers to inject arbitrary web script or HTML via unknown vectors...
Plone CMS < 5.0.5 Information Disclosure Vulnerability
Plone CMS is prone to an information disclosure vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...
Plone CMS < 5.0.5 Privilege Escalation Vulnerability
Plone CMS is prone to a privilege escalation vulnerability in WebDAV requests. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...
CVE-2016-4041
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors...
Security feature bypass
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors...
CVE-2016-4043
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
Authentication flaw
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
Information disclosure
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors...
PYSEC-2017-55
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors...
PYSEC-2017-56
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors...
PYSEC-2017-55
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors...
CVE-2016-4042
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors...
PYSEC-2017-56
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors...
CVE-2016-4043
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...
PYSEC-2017-57
Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...