CVE-2016-7136

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting XSS attacks via a crafted GET request...

PYSEC-2017-58

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

CVE-2016-7136

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting XSS attacks via a crafted GET request...

CVE-2016-7139

Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2016-7136

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting XSS attacks via a crafted GET request...

CVE-2016-7135

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

CVE-2016-7135

CVE-2016-7135: Directory traversal in Plone CMS (versions 5.x up to 5.0.6 and 4.2.x up to 4.3.11) allows remote administrators to read arbitrary files via a .. in the path parameter of a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions. Root cause is unsanit...

CVE-2016-7138

CVE-2016-7138 is a cross-site scripting (XSS) vulnerability in Plone CMS’s URL checking infrastructure. Affects Plone 5.x up to 5.0.6, 4.x up to 4.3.11, and 3.3.x up to 3.3.6. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL. The Connected documents confi...

CVE-2016-7138

Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-7139

Cross-site scripting XSS vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2016-7135

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions...

CVE-2016-7137

CVE-2016-7137 concerns multiple open redirects in Plone CMS versions 5.x (up to 5.0.6), 4.x (up to 4.3.11), and 3.3.x (up to 3.3.6). The vulnerability allows remote attackers to redirect users to arbitrary sites and facilitate phishing by supplying crafted URLs via (1) the referer parameter targe...

CVE-2016-7136

Plone CMS 5.x up to 5.0.6 and 4.x up to 4.3.11 is affected by CVE-2016-7136 due to z3c.form, enabling remote XSS via a crafted GET request. Root cause: improper handling in z3c.form that allows injected scripts. Impact: cross-site scripting could compromise user sessions or site integrity. Remedi...

CVE-2016-7140

Multiple cross-site scripting XSS vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7140

Multiple cross-site scripting XSS vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7140

CVE-2016-7140 is a cross-site scripting (XSS) vulnerability in the ZMI page of Zope2 used by Plone CMS. The issue affects Plone versions 5.x up to 5.0.6, 4.x up to 4.3.11, and 3.3.x up to 3.3.6, enabling remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connecte...

CVE-2016-7139

CVE-2016-7139 is a cross-site scripting (XSS) vulnerability in Plone CMS, affecting Plone 5.x up to 5.0.6, 4.x up to 4.3.11, and 3.3.x up to 3.3.6. The flaw is described as an XSS in an unspecified page template, allowing remote attackers to inject arbitrary web script or HTML via unknown vectors...

CVE-2016-7137

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...

CVE-2016-7138

Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2016-7137

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...