CVE-2011-1949

CVE-2011-1949 is a Plone XSS issue in the PortalTransforms safe_html filter (Plone 2.1–4.1). The vulnerability allows remote authenticated users to inject arbitrary script or HTML via unspecified vectors, caused by the safe_html transform path. This is described as a different vulnerability from ...

CVE-2011-1948

CVE-2011-1948 is a documented cross-site scripting (XSS) vulnerability affecting Plone 4.1 and earlier, where a crafted URL could cause remote attackers to inject arbitrary web script or HTML. Several connected sources corroborate XSS in Plone-related components (e.g., GHSA- P7H9-VF92-5FJ5 and re...

CVE-2011-1948

Cross-site scripting XSS vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2011-1950

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011...

CVE-2011-1949

Cross-site scripting XSS vulnerability in the safehtml filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422...

VulnCheck KEV: CVE-2011-1950

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011...

PT-2011-3491 · Plone +1 · Plone +1

Name of the Vulnerable Software and Affected Versions: Plone versions 4.1 and earlier Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Recommendations: For Plone versions 4.1 and earlier, update to a version later than...

[CVE-REQUEST] Plone XSS and permission errors

Hello all, As a member of the Plone security response team I hereby notify you that we have been made aware of three distinct security holes in Plone and are requesting CVE identifiers. 1. Reflected XSS attack A crafted URL can display arbitrary HTML output 2. Persistent XSS attack Certain valid...

Plone Detection

The remote host is running Plone, a free content management system written in Python. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid53545; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/03/24"; scriptnameenglish:"Plone...

Plone Security Bypass

The version of Plone on the remote host fails to require authentication to access several sensitive functions. Plone is built on top of Zope, which maps Python objects and their methods to URLs. Methods can have security restrictions, such as requiring a login account or a specific privilege leve...

plone: unauthorized remote administrative access

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

plone: unauthorized remote administrative access

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

FreeBSD Ports: plone

The remote host is missing an update to the system as announced in the referenced advisory. VID 7c492ea2-3566-11e0-8e81-0022190034c0 OpenVAS Vulnerability Test $ Description: Auto generated from VID 7c492ea2-3566-11e0-8e81-0022190034c0 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

FreeBSD Ports: plone

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2011-0720

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

PYSEC-2011-13

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

PYSEC-2011-13

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

Sql injection

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

CVE-2011-0720

CVE-2011-0720 affects Plone 2.5–4.0 as used in Conga and luci. The vulnerability enables a remote attacker to obtain administrative access, read or create arbitrary content, and change the site skin via unspecified vectors due to improper access controls in the Conga/luci web components. Public a...

CVE-2011-0720

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...