CVE-2012-5491

z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...

CVE-2012-5488

CVE-2012-5488 affects Plone components bundled with luci (e.g., Plone versions before 4.2.3 and 4.3 before beta 1). The vulnerability allows remote attackers to execute Python code via a crafted URL, related to createObject in python_scripts.py. Connected advisories confirm a remote code executio...

CVE-2012-5496

kupuspellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service ZServer thread lock via a crafted URL...

CVE-2012-5488

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject...

CVE-2012-5497

Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...

CVE-2012-5490

Cross-site scripting XSS vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5501

atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs Files and Images stored on custom content types via a crafted URL...

CVE-2012-5504

Cross-site scripting XSS vulnerability in widgettraversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5502

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5502

CVE-2012-5502: XSS in Plone?safe_html.py (Plone before 4.2.3 and 4.3 before beta 1) allows remote authenticated users with edit permissions to inject arbitrary script/HTML via unspecified vectors. Exact fix version is not specified in the provided documents; references show patches/releases aroun...

CVE-2012-5489

CVE-2012-5489 affects Zope’s App.Undo.UndoSupport.get_request_var_or_attr in Zope versions before 2.12.21 and 3.13.x before 2.13.11, used by Plone before 4.2.3 and 4.3 before beta 1. The root cause is insufficient access control on restricted attributes, allowing remote authenticated users to acc...

luci, ricci security update

CentOS Errata and Security Advisory CESA-2014:1194 Updated conga packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVS...

Moderate: Red Hat Security Advisory: conga security and bug fix update

Updated conga packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

(Plone): Anonymous users can list user account names

It was discovered that Plone, included as a part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially crafted URL that, when processed, could allow the attacker to enumerate user account names...

(Plone): Partial denial of service through Collections functionality

It was discovered that Plone, included as a part of luci, did not properly handle the processing of requests for certain collections. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive I/O and/or cache resource consumption...

(Plone): Partial denial of service through internal function

It was discovered that Plone, included as a part of luci, did not properly handle the processing of very large values passed to an internal utility function. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive memory consumption...

(Plone): Restricted Python injection

It was discovered that Plone, included as a part of luci, did not properly protect the administrator interface control panel. A remote attacker could use this flaw to inject a specially crafted Python statement or script into Plone's restricted Python sandbox that, when the administrator interfac...

(Plone): Anonymous users can batch change titles of content items

It was discovered that Plone, included as a part of luci, allowed a remote anonymous user to change titles of content items due to improper permissions checks...

(Plone): Reflexive HTTP header injection

It was discovered that Plone, included as a part of luci, did not properly sanitize HTTP headers provided within certain URL requests. A remote attacker could use a specially crafted URL that, when processed, would cause the injected HTTP headers to be returned as a part of the Plone HTTP respons...

(Plone): Restricted Python injection

It was discovered that Plone, included as a part of luci, did not properly protect the privilege of running RestrictedPython scripts. A remote attacker could use a specially crafted URL that, when processed, would allow the attacker to submit and perform expensive computations or, in conjunction...