1425 matches found
CVE-2012-5505
Plone vulnerability CVE-2012-5505 affects Plone before 4.2.3 and 4.3 before beta 1, where atat.py allows remote attackers to read private data structures by requesting a view without a name. This is an information disclosure flaw in the view-dispatch path, enabling leakage of private structures w...
CVE-2012-5493
Summary (CVE-2012-5493) : The issue affects Plone prior to 4.2.3 and Plone 4.3 prior to beta 1, where the gtbn.py module allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code through unspecified vectors. The affected component is...
CVE-2012-5496
CVE-2012-5496 affects kupu_spellcheck.py in Kupu for Plone before 4.0, where a crafted URL can trigger a denial-of-service by locking the ZServer thread. Descriptions across connected advisories confirm the DoS via crafted URL vulnerability; no exploitation details or affected versions beyond “Pl...
CVE-2012-5487
The Plone sandbox bypass CVE-2012-5487 affects Plone before 4.2.3 and 4.3 before beta 1, where the sandbox whitelisting function (allowmodule.py) can be bypassed, allowing remote authenticated users with certain privileges to execute arbitrary Python code via importing vectors. The vulnerability ...
CVE-2012-5489
The App.Undo.UndoSupport.getrequestvarorattr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors...
CVE-2012-5498
queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection...
CVE-2012-5503
ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors...
CVE-2012-5504
CVE-2012-5504 affects Plone’s widget_traversal.py, with vulnerable versions: Plone before 4.2.3 and 4.3 before beta1. The issue is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. No exploit details are provided in the ...
CVE-2012-5501
atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs Files and Images stored on custom content types via a crafted URL...
CVE-2012-5488
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject...
CVE-2012-5490
Plone XSS in kssdevel.py affects Plone before 4.2.3 and 4.3 before beta1, enabling remote script/HTML injection via unspecified vectors. Root cause specifics are not provided in the description. Remediation indicated by connected advisories: apply the Plone security fixes (hotfix/releases around ...
CVE-2012-5499
pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service memory consumption via a large value, related to formatColumns...
CVE-2012-5498
CVE-2012-5498 affects Plone (the CMS) where queryCatalog.py in Plone versions before 4.2.3 and before beta1 of 4.3 can bypass caching, enabling a remote attacker to cause a denial of service via a crafted request to a collection. The NVD cites a base score of 5.0 (Medium) with network access and ...
CVE-2012-5501
Plone vulnerability CVE-2012-5501 affects at_download.py in Plone before 4.2.3 and 4.3 before beta 1, enabling remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL. The connected records consistently describe this exact issue and cite Plone-...
CVE-2012-5485
CVE-2012-5485 affects Plone (as part of conga/luci) where registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote code execution via the admin interface. Root cause is improper handling in the RestrictedPython sandbox when processing admin actions, enabling a remote attacke...
CVE-2012-5507
CVE-2012-5507 affects Zope before 2.13.19 (as used in Plone before 4.2.3 and in 4.3 before beta 1). A timing-attack vulnerability in AccessControl/AuthEncoding.py could let remote attackers obtain passwords during validation. The issue is documented in multiple advisories under Plone/Zope referen...
CVE-2012-5488
CVE-2012-5488 affects Plone components bundled with luci (e.g., Plone versions before 4.2.3 and 4.3 before beta 1). The vulnerability allows remote attackers to execute Python code via a crafted URL, related to createObject in python_scripts.py. Connected advisories confirm a remote code executio...
CVE-2012-5499
CVE-2012-5499 affects Plone prior to 4.2.3 and 4.3 prior to beta 1. The vulnerability is triggered by a large value in python_scripts.py, related to formatColumns, enabling a remote DoS via memory consumption. Affected component: Plone (within the Python sandbox) as part of luci/conga deployments...