1428 matches found
CVE-2012-5505
Plone vulnerability CVE-2012-5505 affects Plone before 4.2.3 and 4.3 before beta 1, where atat.py allows remote attackers to read private data structures by requesting a view without a name. This is an information disclosure flaw in the view-dispatch path, enabling leakage of private structures w...
CVE-2012-5489
CVE-2012-5489 affects Zope’s App.Undo.UndoSupport.get_request_var_or_attr in Zope versions before 2.12.21 and 3.13.x before 2.13.11, used by Plone before 4.2.3 and 4.3 before beta 1. The root cause is insufficient access control on restricted attributes, allowing remote authenticated users to acc...
CVE-2012-5499
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service memory consumption via a large value, related to formatColumns...
CVE-2012-5507
CVE-2012-5507 affects Zope before 2.13.19 (as used in Plone before 4.2.3 and in 4.3 before beta 1). A timing-attack vulnerability in AccessControl/AuthEncoding.py could let remote attackers obtain passwords during validation. The issue is documented in multiple advisories under Plone/Zope referen...
CVE-2012-5497
membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...
CVE-2012-5494
Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...
CVE-2012-5495
CVE-2012-5495 affects Plone where python_scripts.py can allow remote code execution via a crafted URL (related to “go_back”). Affected versions include Plone up to 4.2.3 and 4.3 up to beta 1. Root cause involves Python code execution from an attacker-controlled URL. The vulnerability allows remot...
CVE-2012-5496
CVE-2012-5496 affects kupu_spellcheck.py in Kupu for Plone before 4.0, where a crafted URL can trigger a denial-of-service by locking the ZServer thread. Descriptions across connected advisories confirm the DoS via crafted URL vulnerability; no exploitation details or affected versions beyond “Pl...
CVE-2012-5487
The sandbox whitelisting function allowmodule.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing...
CVE-2012-5505
atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...
CVE-2012-5506
The CVE-2012-5506 entry affects Plone: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) by issuing an RSS feed request for a folder the user does not have permission to access. Connected advisories corroborate the s...
CVE-2012-5501
Plone vulnerability CVE-2012-5501 affects at_download.py in Plone before 4.2.3 and 4.3 before beta 1, enabling remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL. The connected records consistently describe this exact issue and cite Plone-...
CVE-2012-5491
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...
CVE-2012-5506
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...
CVE-2012-5492
uidcatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL...
CVE-2012-5488
CVE-2012-5488 affects Plone components bundled with luci (e.g., Plone versions before 4.2.3 and 4.3 before beta 1). The vulnerability allows remote attackers to execute Python code via a crafted URL, related to createObject in python_scripts.py. Connected advisories confirm a remote code executio...
CVE-2012-5496
kupuspellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service ZServer thread lock via a crafted URL...
CVE-2012-5488
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject...
CVE-2012-5497
Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...