PYSEC-2014-52

traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors related to "retrieving information for certain resources."...

PYSEC-2014-56

sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors...

PYSEC-2014-57

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL...

CVE-2013-4194

The CVE-2013-4194 entry concerns the WYSIWYG component (wysiwyg.py) in Plone versions 2.1–4.1, 4.2.x up to 4.2.5, and 4.3.x up to 4.3.1. The connected GHSA advisory and OSV entries corroborate that remote attackers can obtain sensitive information by crafting a URL that causes an error message to...

CVE-2013-4191

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive...

CVE-2013-4189

Multiple unspecified vulnerabilities in 1 dataitems.py, 2 get.py, and 3 traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors...

CVE-2013-4188

traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service infinite loop and resource consumption via unspecified vectors related to "retrieving information for certain resources."...

CVE-2013-4189

Multiple unspecified vulnerabilities in 1 dataitems.py, 2 get.py, and 3 traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors...

CVE-2013-4190

Multiple cross-site scripting XSS vulnerabilities in 1 spamProtect.py, 2 pts.py, and 3 request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4191

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive...

CVE-2013-4193

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL...

CVE-2013-4196

The object manager implementation objectmanager.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-4197

memberportrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors...

CVE-2013-4198

mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality...

CVE-2013-4199

1 cbdecode.py and 2 linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service resource consumption via a large zip archive, which is expanded decompressed...

CVE-2013-4191

Affected software: Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. Issue: zip.py does not properly enforce access restrictions when including content in a zip archive, leading to potential information disclosure. Impact: remote attackers may read a generated archive and obtain sensitive information....

CVE-2013-4193

The CVE-2013-4193 entry concerns Plone: the component typeswidget.py in Plone versions 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1 fails to enforce the immutable setting on unspecified content edit forms, allowing remote attackers to hide fields on the forms through a crafted URL. This is corroborated ...

CVE-2013-4189

CVE-2013-4189: Affects Plone components dataitems.py, get.py, and traverseName.py across Plone versions 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. Description indicates remote authenticated users with administrator access can access nodes above a subtree via unknown vectors. The connected advisories ...

CVE-2013-4190

CVE-2013-4190 : Multiple XSS vulnerabilities in Plone components (spamProtect.py, pts.py, request.py) affect Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. The root cause is unsanitized input allowing injection of arbitrary script/HTML via unspecified vectors. Corresponding advisories indicate a ho...

CVE-2013-4195

CVE-2013-4195 (Plone) is a set of multiple open redirect vulnerabilities in modules marmoset_patch.py, publish.py, and principiaredirect.py affecting Plone 2.1–4.1, 4.2.x–4.2.5, and 4.3.x–4.3.1. The underlying issue is open redirects that let remote attackers redirect users to arbitrary sites, en...