PT-2011-3493

Name of the Vulnerable Software and Affected Versions Plone versions 4.0 through 4.1 Description The issue allows remote authenticated users to modify the properties of arbitrary accounts. This has been exploited in the wild. Recommendations For versions 4.0 through 4.1, update to a version that...

PT-2011-3492

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 4.1 Description A cross-site scripting XSS issue exists in the safe html filter in Products.PortalTransforms, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

VulnCheck KEV: CVE-2011-1950

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011...

[CVE-REQUEST] Plone XSS and permission errors

Hello all, As a member of the Plone security response team I hereby notify you that we have been made aware of three distinct security holes in Plone and are requesting CVE identifiers. 1. Reflected XSS attack A crafted URL can display arbitrary HTML output 2. Persistent XSS attack Certain valid...

Plone Detection

The remote host is running Plone, a free content management system written in Python. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid53545; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/03/24"; scriptnameenglish:"Plone...

Plone Security Bypass

The version of Plone on the remote host fails to require authentication to access several sensitive functions. Plone is built on top of Zope, which maps Python objects and their methods to URLs. Methods can have security restrictions, such as requiring a login account or a specific privilege leve...

plone: unauthorized remote administrative access

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

plone: unauthorized remote administrative access

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

FreeBSD Ports: plone

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: plone

The remote host is missing an update to the system as announced in the referenced advisory. VID 7c492ea2-3566-11e0-8e81-0022190034c0 OpenVAS Vulnerability Test $ Description: Auto generated from VID 7c492ea2-3566-11e0-8e81-0022190034c0 Authors: Thomas Reinke Copyright: Copyright c 2011 E-Soft Inc...

CVE-2011-0720

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

PYSEC-2011-13

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

Sql injection

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

PYSEC-2011-13

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

CVE-2011-0720

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

CVE-2011-0720

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

CVE-2011-0720

CVE-2011-0720 affects Plone 2.5–4.0 as used in Conga and luci. The vulnerability enables a remote attacker to obtain administrative access, read or create arbitrary content, and change the site skin via unspecified vectors due to improper access controls in the Conga/luci web components. Public a...

CVE-2011-0720: Undefined Security Weakness

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

PT-2011-2583

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 4.0 Description The issue allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin. Recommendations For Plone versions 2.5 through 4.0, at the moment, there ...

plone -- Remote Security Bypass

Plone developer reports: This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still ...