CVE-2008-1393

Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network...

CVE-2008-1395

Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session...

CVE-2008-0164

Multiple cross-site request forgery CSRF vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to 1 add arbitrary accounts via the joinform page and 2 change the privileges of arbitrary groups via the prefsgroupsoverview page...

CVE-2008-1394

Plone CMS before 3 places a base64 encoded form of the username and password in the ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network...

CVE-2008-1395

CVE-2008-1395 affects the Plone CMS. The vulnerability arises because Plone does not record users’ authentication states and implements logout purely on the client side, which can allow context-dependent attackers to reuse a logged-out session. The available documents describe the issue and its i...

CVE-2008-1394

Plone CMS before v3 stores a base64-encoded form of the username and password in the __ac cookie for all user accounts, enabling credential exposure via network sniffing. Root cause: insecure cookie handling that reveals credentials. Impact: remote attackers could gain access by sniffing traffic....

CVE-2008-1393

Plone CMS before version 3 (e.g., 3.0.5 and likely other 3.x) stores a base64-encoded form of the admin username and password in the __ac cookie, enabling an attacker who can sniff network traffic to obtain administrative privileges. Connected advisories (GHSA-593C-J348-F3GV; OSV) corroborate imp...

CVE-2008-1396

CVE-2008-1396 affects Plone CMS 3.x . The issue is in how Plone computes the HMAC-SHA1 value for the authentication cookie: it uses invariant data (a client username and a server secret), which can enable remote attackers to gain permanent access to a user account by sniffing network traffic. The...

PR08-02: Plone CMS Security Research - the Art of Plowning

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-02: Plone CMS Security Research: the Art of Plowning Product description: Plone is a ready-to-run content management system built on the powerful, and free, Zope application server. Plone is easy to set up, extremely flexible, and provides you wi...

Debian: Security Advisory (DSA-1405-2)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-1032-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1032-1 (zope-cmfplone)

The remote host is missing an update to zope-cmfplone announced via advisory DSA 1032-1. It was discovered that the Plone content management system lacks security declarations for three internal classes. This allows manipulation of user portraits by unprivileged users. The old stable distribution...

Debian Security Advisory DSA 1405-1 (zope-cmfplone)

The remote host is missing an update to zope-cmfplone announced via advisory DSA 1405-1. OpenVAS Vulnerability Test $Id: deb14051.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1405-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

[SECURITY] [DSA 1405-3] New zope-cmfplone packages fix regression

-------------------------------------------------------------------------- Debian Security Advisory DSA 1405-3 [email protected] http://www.debian.org/security/ Thijs Kinkhorst December 1st, 2007 http://www.debian.org/security/faq -...

FreeBSD : plone -- unsafe data interpreted as pickles (ffba6ab0-90b5-11dc-9835-003048705d5a)

Plone projectreports : This hotfix corrects a vulnerability in the statusmessages and linkintegrity modules, where unsafe network data was interpreted as python pickles. This allows an attacker to run arbitrary python code within the Zope/Plone process. %NASLMINLEVEL 70300 C Tenable Network...

DSA-1405-2 zope-cmfplone - arbitrary code

Bulletin has no description...

[SECURITY] [DSA 1405-1] New zope-cmfplone packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1405-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst November 9th, 2007 http://www.debian.org/security/faq -...

DSA-1405-1 zope-cmfplone - arbitrary code

Bulletin has no description...

PYSEC-2007-4

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the 1 statusmessages or 2 linkintegrity module, which the module unpickles and executes...

PYSEC-2007-4

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the 1 statusmessages or 2 linkintegrity module, which the module unpickles and executes...