1428 matches found
PYSEC-2014-48
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...
PYSEC-2014-27
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface...
PYSEC-2014-74
The App.Undo.UndoSupport.getrequestvarorattr function in Zope before 2.12.21 and 2.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors...
PYSEC-2014-41
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service memory consumption via a large value, related to formatColumns...
PYSEC-2014-44
Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...
PYSEC-2014-73
ZPublisher.HTTPRequest.scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed LF character...
PYSEC-2014-46
Cross-site scripting XSS vulnerability in widgettraversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
PYSEC-2014-75
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...
CVE-2012-5486
CVE-2012-5486 - HP: ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19 (used in Plone before 4.3 beta 1) allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. Affected components: Zope 2 series up to 2.13.18; Plone deployments including the Plone before...
CVE-2012-5485
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface...
CVE-2012-5507
CVE-2012-5507 affects Zope before 2.13.19 (as used in Plone before 4.2.3 and in 4.3 before beta 1). A timing-attack vulnerability in AccessControl/AuthEncoding.py could let remote attackers obtain passwords during validation. The issue is documented in multiple advisories under Plone/Zope referen...
CVE-2012-5504
CVE-2012-5504 affects Plone’s widget_traversal.py, with vulnerable versions: Plone before 4.2.3 and 4.3 before beta1. The issue is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. No exploit details are provided in the ...
CVE-2012-5489
The App.Undo.UndoSupport.getrequestvarorattr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors...
CVE-2012-5503
ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors...
CVE-2012-5507
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation...
CVE-2012-5503
Plone contains a vulnerability in ftp.py where remote attackers can read hidden folder contents. Affected versions are Plone before 4.2.3 and 4.3 before beta 1. The description does not specify the exact vectors, root cause details, or practical exploitation steps, and no remediation is provided ...
CVE-2012-5495
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "goback."...
CVE-2012-5491
The CVE-2012-5491 entry concerns information disclosure in the Plone ecosystem via z3c.form. Affected software includes Plone versions prior to 4.2.3 and 4.3 prior to beta 1, where an attacker who knows the form location and element id can obtain the default form field values remotely. The underl...
CVE-2012-5492
Plone uid_catalog.py vulnerability: affects Plone before 4.2.3 and 4.3 before beta 1; remote attacker can obtain metadata about hidden objects via a crafted URL. Mitigation is to upgrade to Plone 4.2.3+ (or 4.3 beta1+ per advisories).