PYSEC-2020-90

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT overwrite some content without needing write permission...

PYSEC-2020-89

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking...

CVE-2020-7936

CVE-2020-7936 describes an open redirect in Plone 4.0–5.2.1 on the login form (and possibly other entry points). The vulnerability allows an attacker to craft a link that, after following and possibly after login, redirects the user to the attacker's site. Affected software is Plone (4.0–5.2.1); ...

CVE-2020-7936

An open redirect on the login form and possibly other places in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site...

CVE-2020-7937

CVE-2020-7937 is an XSS vulnerability in the title field of Plone 5.0–5.2.1. The issue allows users with a certain privilege level to inject JavaScript that executes for other site visitors. The core vulnerability is in the title field handling, enabling stored or reflected XSS depending on conte...

CVE-2020-7937

An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...

CVE-2020-7938

plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level...

CVE-2020-7938

Plone 5.2.0–5.2.1 with plone.restapi contains a privilege-escalation flaw that lets users with a certain privilege level elevate to the highest level. The issue, tracked as CVE-2020-7938, affects the REST API component and can impact confidentiality, integrity, and availability. The connected sou...

CVE-2020-7939

CVE-2020-7939 is a Plone/DTML SQL injection vulnerability, affecting Plone 4.0–5.2.1 (problem in Zope). The connected documents describe the issue as SQL injection in DTML or in connection objects, enabling unwanted SQL queries. No explicit exploit status is provided in the documents, and the mat...

CVE-2020-7939

SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...

CVE-2020-7940

Plone 4.3–5.2.0 is affected by CVE-2020-7940 due to missing password strength checks on certain forms, enabling weak passwords and easier cracking. Root cause: insufficient validation of password strength in the affected forms. Impact: weak passwords could be set by users, reducing account securi...

CVE-2020-7940

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking...

CVE-2020-7941

CVE-2020-7941 is a privilege-escalation flaw in Plone’s plone.app.contenttypes (versions 4.3–5.2.1) that allows a user to PUT/overwrite content without write permission. The issue affects the content-overwrite pathway and can impact confidentiality, integrity, and availability as described in the...

CVE-2020-7941

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT overwrite some content without needing write permission...

Authorization Bypass

plone.app.contenttypes is vulnerable to authorization bypass. The vulnerability exists as a user might be able to use a PUT request to overwrite content without requiring the write permission...

Plone and Zope 'BrowserIdManager.py' Cross-Site Scripting Vulnerability

Zope is Zope's set of Python-based open source object-oriented Web application server . Plone is the United States Plone Foundation's set of free and open source content management system built on Zope CMS. A cross-site scripting vulnerability exists in Plone and Zope that stems from the program...

CVE-2013-7062

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...

PYSEC-2020-218

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...

CVE-2013-7062

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...