Cross-site Scripting (XSS)

plone is vulnerable to cross-site scripting XSS. It is possible to perform a reflected XSS via the ZMI managefindResult. This vulnerability exists because of an incomplete fix for CVE-2016-7140...

Plone Local File Inclusion Vulnerability

Plone is the United States Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A...

Information Disclosure

Plone is vulnerable to information disclosure. z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...

Plone - 'in_portal.py' <= 4.1.3 Session Hijacking

source: http://www.securityfocus.com/bid/61964/info Plone is prone to a session-hijacking vulnerability. An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application. Note: This issue was previously discussed in the BID 61544 Plone Multiple...

Update — Hacker Claims to Have Hacked the FBI, But It Wasn't

Update: A hacker yesterday claimed to have hacked the FBI's website running on Plone CMS, but it seems it wasn't hacked using any zero-day vulnerability in Plone. We contacted Plone security team and updated this story see below with official statements. A hacker, using Twitter handle CyberZeist,...

Plone CMS < 4.3.12, 5.x < 5.0.7 Multiple Vulnerabilities

Plone CMS is prone to multiple vulnerabilities. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Plone CMS 4.3.11 / 5.0.6 XSS / Traversal / Open Redirection

Product Description Plone is a free and open source content management system built on top of the Zope application server. Plone is positioned as an "Enterprise CMS" and is most commonly used for intranets and as part of the web presence of large organizations Systems Affected Product : Plone...

CVE-2016-7139

Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2016-7140

Multiple cross-site scripting XSS vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7137

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...

CVE-2016-7138

Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-7136

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting XSS attacks via a crafted GET request...

CVE-2016-7135

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

plone file system information disclosure vulnerability

Plone is a free, open source Content Management System CMS. An information disclosure vulnerability exists in the plone file system. An attacker could exploit this vulnerability to read data on a target machine running plone by using relative paths and guessing the location of the Plone server...

plone reflective cross-site scripting vulnerability (CNVD-2016-07280)

Plone is a free, open source Content Management System CMS. Plone's URL detection architecture includes a way to detect if the URL is valid and located in plone's site. XSS can be achieved by passing js into a specially crafted url...

plone reflective cross-site scripting vulnerability (CNVD-2016-07281)

Plone is a free, open source Content Management System CMS. A reflected cross-site scripting vulnerability exists in plone, and non-escaped user input in plone page templates could lead to XSS attacks...

plone open redirect vulnerability

Plone is a free, open source Content Management System CMS. plone blindly uses referer headers in multiple places to redirect users to another page after a specific action. An attacker could exploit this vulnerability to attack users...

plone reflective cross-site scripting vulnerability (CNVD-2016-07278)

Plone is a free, open source Content Management System CMS. Plone suffers from a reflected cross-site scripting vulnerability that allows an attacker to inject potential cross-site scripting attacks into forms...

Plone Zope Management (ZMI) Reflective Cross-Site Scripting Vulnerability

Plone is a free, open source Content Management System CMS. A reflected cross-site scripting vulnerability exists in Plone Zope Management ZMI, where the ZMI page of Zope2 does not properly escape user input in many places...

Plone Elevation of Privilege Vulnerability

Plone is the United States Plone Foundation's set of free and open source content management system CMS built on the application server Zope. A privilege extraction vulnerability exists in webdav in Plone versions 5.0 through 5.1a1 and 4.0 through 4.3.9, which can be exploited by an attacker to...