PYSEC-2014-30

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject...

PYSEC-2014-36

Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...

PYSEC-2014-45

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors...

PYSEC-2014-43

atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs Files and Images stored on custom content types via a crafted URL...

PYSEC-2014-48

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...

CVE-2012-5506

The CVE-2012-5506 entry affects Plone: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) by issuing an RSS feed request for a folder the user does not have permission to access. Connected advisories corroborate the s...

CVE-2012-5506

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...

CVE-2012-5495

CVE-2012-5495 affects Plone where python_scripts.py can allow remote code execution via a crafted URL (related to “go_back”). Affected versions include Plone up to 4.2.3 and 4.3 up to beta 1. Root cause involves Python code execution from an attacker-controlled URL. The vulnerability allows remot...

CVE-2012-5493

Summary (CVE-2012-5493) : The issue affects Plone prior to 4.2.3 and Plone 4.3 prior to beta 1, where the gtbn.py module allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code through unspecified vectors. The affected component is...

CVE-2012-5505

Plone vulnerability CVE-2012-5505 affects Plone before 4.2.3 and 4.3 before beta 1, where atat.py allows remote attackers to read private data structures by requesting a view without a name. This is an information disclosure flaw in the view-dispatch path, enabling leakage of private structures w...

CVE-2012-5491

z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...

CVE-2012-5502

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5485

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface...

CVE-2012-5497

Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...

CVE-2012-5496

kupuspellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service ZServer thread lock via a crafted URL...

CVE-2012-5491

The CVE-2012-5491 entry concerns information disclosure in the Plone ecosystem via z3c.form. Affected software includes Plone versions prior to 4.2.3 and 4.3 prior to beta 1, where an attacker who knows the form location and element id can obtain the default form field values remotely. The underl...

CVE-2012-5493

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors...

CVE-2012-5494

Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...

CVE-2012-5492

uidcatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL...

CVE-2012-5487

The sandbox whitelisting function allowmodule.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing...