1428 matches found
CVE-2017-1000481
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...
CVE-2017-1000481
The CVE-2017-1000481 issue affects Plone 2.5–5.1rc1 where a login flow uses a came_from parameter to redirect after login. A malformed/crafted link can lead users to an attacker’s site or allow attacker-controlled JavaScript execution; Plone’s isURLInPortal checks mitigate, but additional bypasse...
CVE-2017-1000482
CVE-2017-1000482 affects Plone 2.5–5.1rc1. An attacker could inject JavaScript into the home_page property of a user’s profile, causing script execution when a visitor clicks the home page link on the author page. Root cause: storing executable JS in the home_page field. Impact reported as XSS to...
CVE-2017-1000482
A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...
CVE-2017-1000483
CVE-2017-1000483 affects Plone 2.5–5.1rc1 where private content can be accessed via str.format in through-the-web templates and scripts. The issue stems from the format method exposure, with the hotfix originally addressing this and noting the format method is from Python 2.6, making the fix rele...
CVE-2017-1000481
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...
Plone Design Vulnerability
Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A design...
Zope Management Interface and Plone Cross-Site Request Forgery Vulnerabilities
Plone is the United States Plone Foundation's set of free and open source content management system CMS built on the application server Zope. Zope Management Interface ZMI is one of the management interface. A cross-site request forgery vulnerability exists in Zope Management Interface versions...
Plone header injection vulnerability
Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A security...
Plone Cross-Site Scripting Vulnerability
Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A cross-sit...
PYSEC-2017-51
Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...
PYSEC-2017-51
Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...
CVE-2015-7293
Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...
CVE-2015-7293
Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...
CVE-2015-7293
The CVE concerns multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface (ZMI) 4.3.7 and earlier, and Plone before 5.x. The affected component is the ZMI/Plone web interfaces built on Zope, with the root cause being CSRF weaknesses that could allow unauthorized act...
PYSEC-2017-54
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses...
PYSEC-2017-54
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses...
PYSEC-2017-53
Cross-site scripting XSS vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1...
PYSEC-2017-52
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator...