PYSEC-2014-54

Multiple cross-site scripting XSS vulnerabilities in 1 spamProtect.py, 2 pts.py, and 3 request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4198

The CVE-2013-4198 entry applies to Plone: mail_password.py in Plone 2.1–4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1. The vulnerability allows remote authenticated users to bypass the prohibition on password changes via the forgotten-password email flow. Affected component/function/file: mai...

CVE-2013-4193

The CVE-2013-4193 entry concerns Plone: the component typeswidget.py in Plone versions 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1 fails to enforce the immutable setting on unspecified content edit forms, allowing remote attackers to hide fields on the forms through a crafted URL. This is corroborated ...

CVE-2013-4191

Affected software: Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. Issue: zip.py does not properly enforce access restrictions when including content in a zip archive, leading to potential information disclosure. Impact: remote attackers may read a generated archive and obtain sensitive information....

CVE-2013-4188

CVE-2013-4188 affects Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. The issue enables remotely authenticated attackers with administrator privileges to trigger a denial of service (infinite loop and resource consumption) through unspecified vectors related to “retrieving information for certain re...

CVE-2013-4197

Plone CVE-2013-4197 affects member_portrait.py in Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. The issue allows remote authenticated users to modify or delete portraits of other users via unspecified vectors due to an access-control weakness. No exploitation details or direct fix are provided in ...

CVE-2013-4196

Plone vulnerability CVE-2013-4196 affects Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. The objectmanager.py implementation does not properly restrict access to internal methods, allowing remote attackers to obtain sensitive information via a crafted request. This is an information-disclosure issu...

CVE-2013-4194

The CVE-2013-4194 entry concerns the WYSIWYG component (wysiwyg.py) in Plone versions 2.1–4.1, 4.2.x up to 4.2.5, and 4.3.x up to 4.3.1. The connected GHSA advisory and OSV entries corroborate that remote attackers can obtain sensitive information by crafting a URL that causes an error message to...

CVE-2013-4192

Plone sendto.py in versions 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1 allows remote authenticated users to spoof emails via unspecified vectors. The provided documents specify affected versions and the spoofing impact but do not disclose root cause details or a remediation. No exploit specifics are g...

CVE-2013-4199

CVE-2013-4199 affects Plone: cb_decode.py and linkintegrity.py across Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. Remote authenticated users can trigger a denial of service by decompressing a large zip archive, consuming resources (resource exhaustion). No explicit remediation is provided in the...

CVE-2013-4193

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL...

CVE-2013-4195

Multiple open redirect vulnerabilities in 1 marmosetpatch.py, 2 publish.py, and 3 principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-4189

Multiple unspecified vulnerabilities in 1 dataitems.py, 2 get.py, and 3 traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors...

CVE-2013-4197

memberportrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors...

CVE-2013-4191

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive...

CVE-2013-4192

sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors...

CVE-2013-4196

The object manager implementation objectmanager.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-4198

mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality...

CVE-2013-4194

The WYSIWYG component wysiwyg.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message...

CVE-2013-4189

CVE-2013-4189: Affects Plone components dataitems.py, get.py, and traverseName.py across Plone versions 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. Description indicates remote authenticated users with administrator access can access nodes above a subtree via unknown vectors. The connected advisories ...