CVE-2016-4042

Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors...

CVE-2016-4041

Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors...

CVE-2016-4042

Plone CMS versions 3.3 through 5.1a1 are affected by CVE-2016-4042. The issue allows remote attackers to obtain the ID of sensitive content via unspecified vectors, constituting information disclosure. A validated remediation in connected sources indicates affected versions are before 4.3.10 (for...

CVE-2016-4043

CVE-2016-4043 affects Plone 5.0rc1–5.1a1 via Chameleon (five.pt); remote authenticated users can bypass Restricted Python by exploiting permissions to create or edit templates. Root cause: improper handling in template editing allows elevation of privileges within PloneFormGen contexts. Impact is...

Plone 5.0.5 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Plone 5.0.5 Fixed in: Hotfix 20170117 Fixed Version Link: https://plone.org/security/hotfix/20170117 Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/05/2016...

Plone Incompletely Fixes Cross-Site Scripting Vulnerability

Plone is the United States Plone Foundation's set of free and open source content management system CMS built on Zope based on Python's open source object-oriented Web application server.Zope ZMI is one of the management interface. A cross-site scripting vulnerability exists in the managefindResu...

Cross site scripting

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

PYSEC-2017-64

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

CVE-2016-7147

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

UBUNTU-CVE-2016-7147

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

PYSEC-2017-64

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

CVE-2016-7147

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

CVE-2016-7147

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

CVE-2016-7147

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

CVE-2016-7147

CVE-2016-7147 is an XSS in the manage_findResult component of the Zope ZMI search for Plone: Plone 4.x (before 4.3.12) and Plone 5.x (before 5.0.7) are affected. The issue stems from an incomplete fix for CVE-2016-7140 and allows remote attackers to inject arbitrary script/HTML via obj_ids:tokens...

Plone Sandbox Security Bypass Vulnerability

Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed using Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A securi...

Sandbox Escape

plone is vulnerable to sandbox escape. It is possible to access private content via str.format in through-the-web templates and scripts. str.format, Python's new-style string format introduced in 2.6, causes the security issue on untrusted user input. If an attacker can control the string format...

Cross-site Scripting (XSS)

plone is vulnerable to cross-site scripting XSS. It is possible to perform a reflected XSS via the ZMI managefindResult. This vulnerability exists because of an incomplete fix for CVE-2016-7140...

Plone Local File Inclusion Vulnerability

Plone is the United States Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A...

Information Disclosure

Plone is vulnerable to information disclosure. z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...