1399 matches found
CVE-2020-28734
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
CVE-2020-28736
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
CVE-2020-28736
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
CVE-2020-28735
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
CVE-2020-28734
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
CVE-2020-28735
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
Design/Logic Flaw
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
PYSEC-2020-246
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
PYSEC-2020-247
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
Server side request forgery (ssrf)
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
PYSEC-2020-247
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
PYSEC-2020-246
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
Design/Logic Flaw
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
PYSEC-2020-248
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
PYSEC-2020-248
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
CVE-2020-28736
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
CVE-2020-28736
CVE-2020-28736 affects Plone prior to 5.2.3. A XXE vulnerability exists in a feature protected by the unapplied permission plone.schemaeditor.ManageSchemata, making it accessible only to the Manager role. This leads to XML External Entity attacks that could impact confidentiality, integrity, and ...
CVE-2020-28735
CVE-2020-28735 affects Plone versions before 5.2.3, where the tracebacks feature (accessible to the Manager role) enables SSRF attacks. The issue is described across multiple sources as a vulnerability in Plone prior to 5.2.3 that allows server-side request forgery via tracebacks. Remediation is ...