1425 matches found
PYSEC-2014-29
The sandbox whitelisting function allowmodule.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing...
PYSEC-2014-39
membershiptool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL...
PYSEC-2014-48
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...
PYSEC-2014-30
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject...
PYSEC-2014-45
ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors...
CVE-2012-5502
Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-5506
The CVE-2012-5506 entry affects Plone: python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) by issuing an RSS feed request for a folder the user does not have permission to access. Connected advisories corroborate the s...
CVE-2012-5506
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...
CVE-2012-5494
Cross-site scripting XSS vulnerability in pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "u,translate."...
CVE-2012-5493
Summary (CVE-2012-5493) : The issue affects Plone prior to 4.2.3 and Plone 4.3 prior to beta 1, where the gtbn.py module allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code through unspecified vectors. The affected component is...
CVE-2012-5491
The CVE-2012-5491 entry concerns information disclosure in the Plone ecosystem via z3c.form. Affected software includes Plone versions prior to 4.2.3 and 4.3 prior to beta 1, where an attacker who knows the form location and element id can obtain the default form field values remotely. The underl...
CVE-2012-5502
CVE-2012-5502: XSS in Plone?safe_html.py (Plone before 4.2.3 and 4.3 before beta 1) allows remote authenticated users with edit permissions to inject arbitrary script/HTML via unspecified vectors. Exact fix version is not specified in the provided documents; references show patches/releases aroun...
CVE-2012-5487
The Plone sandbox bypass CVE-2012-5487 affects Plone before 4.2.3 and 4.3 before beta 1, where the sandbox whitelisting function (allowmodule.py) can be bypassed, allowing remote authenticated users with certain privileges to execute arbitrary Python code via importing vectors. The vulnerability ...
CVE-2012-5496
CVE-2012-5496 affects kupu_spellcheck.py in Kupu for Plone before 4.0, where a crafted URL can trigger a denial-of-service by locking the ZServer thread. Descriptions across connected advisories confirm the DoS via crafted URL vulnerability; no exploitation details or affected versions beyond “Pl...
CVE-2012-5497
Plone contains a user enumeration flaw (CVE-2012-5497) in membership_tool.py, exploitable via crafted URLs. Affected versions are Plone prior to 4.2.3 and 4.3 prior to beta1. The underlying issue is improper access control on the membership database, enabling remote attackers to enumerate user ac...
CVE-2012-5495
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "goback."...
CVE-2012-5491
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id...
CVE-2012-5493
gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors...