CVE-2016-7140

Multiple cross-site scripting XSS vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7135

CVE-2016-7135: Directory traversal in Plone CMS (versions 5.x up to 5.0.6 and 4.2.x up to 4.3.11) allows remote administrators to read arbitrary files via a .. in the path parameter of a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions. Root cause is unsanit...

CVE-2016-7137

CVE-2016-7137 concerns multiple open redirects in Plone CMS versions 5.x (up to 5.0.6), 4.x (up to 4.3.11), and 3.3.x (up to 3.3.6). The vulnerability allows remote attackers to redirect users to arbitrary sites and facilitate phishing by supplying crafted URLs via (1) the referer parameter targe...

Plone CMS < 5.0.5 Information Disclosure Vulnerability

Plone CMS is prone to an information disclosure vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

Plone CMS < 5.0.5 Privilege Escalation Vulnerability

Plone CMS is prone to a privilege escalation vulnerability in WebDAV requests. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...

CVE-2016-4042

Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors...

Update — Hacker Claims to Have Hacked the FBI, But It Wasn't

Update: A hacker yesterday claimed to have hacked the FBI's website running on Plone CMS, but it seems it wasn't hacked using any zero-day vulnerability in Plone. We contacted Plone security team and updated this story see below with official statements. A hacker, using Twitter handle CyberZeist,...

Plone CMS < 4.3.12, 5.x < 5.0.7 Multiple Vulnerabilities

Plone CMS is prone to multiple vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Plone CMS 4.3.11 / 5.0.6 XSS / Traversal / Open Redirection

Product Description Plone is a free and open source content management system built on top of the Zope application server. Plone is positioned as an "Enterprise CMS" and is most commonly used for intranets and as part of the web presence of large organizations Systems Affected Product : Plone...

CVE-2016-7139

Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2016-7140

Multiple cross-site scripting XSS vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7137

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...

CVE-2016-7138

Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-7136

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting XSS attacks via a crafted GET request...

CVE-2016-7135

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

CVE-2013-6430 Possible XSS when using Spring MVC

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Plone CMS Vendor: Plone Foundation http://plone.org IDs: CSNC-2013-013, CVE-2013-4200 Subject: URL Redirection Vulnerability Risk: High Effect: Remotely exploitable Author: Cyrill Bannwart [email protected]...

CVE-2013-4200 - Plone URL redirection / Forwarding of cookie data &#40;session hijack&#41; in certain browsers

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Plone CMS Vendor: Plone Foundation http://plone.org IDs: CSNC-2013-013, CVE-2013-4200 Subject: URL Redirection Vulnerability Risk: High Effect: Remotely exploitable Author: Cyrill Bannwart [email protected]...

Plone CMS Credential Disclosure

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: Plone CMS Vendor: Plone Foundation http://plone.org IDs: CSNC-2013-013, CVE-2013-4200 Subject: URL Redirection Vulnerability Risk: High Effect: Remotely exploitable Author: Cyrill Bannwart Date: 20/05/2013...

Plone CMS Detection (HTTP)

HTTP based detection of Plone CMS. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.103735";...

Plone CMS 'PloneFormGen' Add-On 1.7.4 - 1.7.8 Arbitrary Code Execution Vulnerability

The PloneFormGen add-on of Plone CMS is prone to an arbitrary code execution vulnerability. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...