1445 matches found
Server Side Request Forgery (SSRF)
plone is vulnerable to server side request forgery. An attacker is able to submit requests on behalf of the server via an event ical URL...
Cross-site Scripting (XSS)
productscmfcore, productspluggableauthservice and plone are vulnerable to cross-site scripting. An attacker is able to inject malicious script through unsanitized user-provided arguments...
Plone cross-site scripting vulnerability (CNVD-2021-37275)
Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the inlinedi...
Plone cross-site scripting vulnerability (CNVD-2021-37195)
Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone versions prior to 5.2.4. The vulnerability can be exploited to cause cross-site scripting with the help of "fullname"...
Plone Arbitrary File Write Vulnerability
Plone is an open source content management system CMS built on the Zope application server. An arbitrary file write vulnerability exists in Plone 5.2.4 and earlier versions. A remote attacker can exploit this vulnerability to perform disk I/O via specially crafted keyword arguments converted by...
Plone server-side request forgery vulnerability (CNVD-2021-37196)
Plone is an open source content management system CMS built on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An authenticated remote attacker can exploit this vulnerability to read a line in a file...
Plone cross-site scripting vulnerability (CNVD-2021-37274)
Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A stored cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited by uploading SVG or HTML documents to conduct...
CVE-2021-33510
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...
CVE-2021-33512
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
CVE-2021-33512
Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...
CVE-2021-33507
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...
CVE-2021-33508
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...
CVE-2021-33513
Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...
CVE-2021-33511
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...
CVE-2021-33511
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...
CVE-2021-33507
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...