CVE-2006-4249

Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group."...

CVE-2006-4249

CVE-2006-4249 (Plone) : Unspecified vulnerability in PlonePAS for Plone 2.5 and 2.5.1 that occurs when anonymous member registration is enabled, allowing an attacker to masquerade as a group. The connected documents confirm the affected product/versions and the impact, but do not provide a detail...

plone -- user can masquerade as a group

Plone.org reports: PlonePAS-using Plone releases Plone 2.5 and Plone 2.5.1 has a potential vulnerability that allows a user to masquerade as a group. Please update your sites...

FreeBSD : plone -- unprotected MembershipTool methods (b6c18956-5fa3-11db-ad2d-0016179b2dd5)

The Plone Team reports : Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the : - changeMemberPortrait - deletePersonalPortrait - testCurrentPassword methods, which allows remote attackers to modify portraits. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

plone -- unprotected MembershipTool methods

The Plone Team reports: Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the: changeMemberPortrait deletePersonalPortrait testCurrentPassword methods, which allows remote attackers to modify portraits...

Debian DSA-1032-1 : zope-cmfplone - programming error

It was discovered that the Plone content management system lacks security declarations for three internal classes. This allows manipulation of user portraits by unprivileged users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

CVE-2006-4247

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

PYSEC-2006-9

Withdrawn as duplicate of PYSEC-2005-5. Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

CVE-2006-4247

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

PYSEC-2006-5

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

PYSEC-2006-5

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

PYSEC-2006-9

Withdrawn as duplicate of PYSEC-2005-5. Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

CVE-2006-4247

CVE-2006-4247 affects Plone 2.5 and 2.5.1 Release Candidate with the Password Reset Tool prior to 0.4.1, enabling attackers to reset other users’ passwords due to an erroneous security declaration. Affected component: Password Reset Tool; vulnerability type: unspecified in detail, but impact is u...

CVE-2006-4247

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

FreeBSD : plone -- 'member_id' Parameter Portrait Manipulation Vulnerability (22c6b826-cee0-11da-8578-00123ffe8333)

Secunia reports : The vulnerability is caused due to missing security declarations in 'changeMemberPortrait' and 'deletePersonalPortrait'. This can be exploited to manipulate or delete another user's portrait via the 'memberid' parameter. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Plone Unprotected MembershipTool Methods Arbitrary Portrait Manipulation

The remote host is running Plone, an open source content manage system written in Python. The version of Plone installed on the remote host does not limit access to the 'changeMemberPortrait' and 'deletePersonalPortrait' MembershipTool methods. An unauthenticated attacker can leverage this issue ...

[SA19633] Plone "member_id" Parameter Portrait Manipulation Vulnerability

TITLE: Plone "memberid" Parameter Portrait Manipulation Vulnerability SECUNIA ADVISORY ID: SA19633 VERIFY ADVISORY: http://secunia.com/advisories/19633/ CRITICAL: Less critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: Plone 2.x http://secunia.com/product/9334/...

plone -- "member_id" Parameter Portrait Manipulation Vulnerability

Secunia reports: The vulnerability is caused due to missing security declarations in "changeMemberPortrait" and "deletePersonalPortrait". This can be exploited to manipulate or delete another user's portrait via the "memberid" parameter...

[SECURITY] [DSA 1032-1] New zope-cmfplone packages fix unprivileged data manipulation

-------------------------------------------------------------------------- Debian Security Advisory DSA 1032-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 12th, 2006 http://www.debian.org/security/faq -...

Plone 2.x - MembershipTool Access Control Bypass

Plone 2.x - MembershipTool Access Control Bypass source: https://www.securityfocus.com/bid/17484/info Plone is susceptible to a remote access-control bypass vulnerability. This issue is due to the application's failure to properly enforce privileges to various MembershipTool methods. This issue...