PYSEC-2006-9

Withdrawn as duplicate of PYSEC-2005-5. Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

PYSEC-2006-5

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

CVE-2006-4247

CVE-2006-4247 affects Plone 2.5 and 2.5.1 Release Candidate with the Password Reset Tool prior to 0.4.1, enabling attackers to reset other users’ passwords due to an erroneous security declaration. Affected component: Password Reset Tool; vulnerability type: unspecified in detail, but impact is u...

CVE-2006-4247

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

CVE-2006-4247: Undefined Security Weakness

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."...

FreeBSD : plone -- 'member_id' Parameter Portrait Manipulation Vulnerability (22c6b826-cee0-11da-8578-00123ffe8333)

Secunia reports : The vulnerability is caused due to missing security declarations in 'changeMemberPortrait' and 'deletePersonalPortrait'. This can be exploited to manipulate or delete another user's portrait via the 'memberid' parameter. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Plone Unprotected MembershipTool Methods Arbitrary Portrait Manipulation

The remote host is running Plone, an open source content manage system written in Python. The version of Plone installed on the remote host does not limit access to the 'changeMemberPortrait' and 'deletePersonalPortrait' MembershipTool methods. An unauthenticated attacker can leverage this issue ...

[SA19633] Plone "member_id" Parameter Portrait Manipulation Vulnerability

TITLE: Plone "memberid" Parameter Portrait Manipulation Vulnerability SECUNIA ADVISORY ID: SA19633 VERIFY ADVISORY: http://secunia.com/advisories/19633/ CRITICAL: Less critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: Plone 2.x http://secunia.com/product/9334/...

plone -- "member_id" Parameter Portrait Manipulation Vulnerability

Secunia reports: The vulnerability is caused due to missing security declarations in "changeMemberPortrait" and "deletePersonalPortrait". This can be exploited to manipulate or delete another user's portrait via the "memberid" parameter...

[SECURITY] [DSA 1032-1] New zope-cmfplone packages fix unprivileged data manipulation

-------------------------------------------------------------------------- Debian Security Advisory DSA 1032-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 12th, 2006 http://www.debian.org/security/faq -...

Plone 2.x - MembershipTool Access Control Bypass

Plone 2.x - MembershipTool Access Control Bypass source: https://www.securityfocus.com/bid/17484/info Plone is susceptible to a remote access-control bypass vulnerability. This issue is due to the application's failure to properly enforce privileges to various MembershipTool methods. This issue...

[SECURITY] [DSA 1032-1] New zope-cmfplone packages fix unprivileged data manipulation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1032-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 12th, 2006 http://www.debian.org/security/faq -...

Plone 2.x - MembershipTool Access Control Bypass

source: https://www.securityfocus.com/bid/17484/info Plone is susceptible to a remote access-control bypass vulnerability. This issue is due to the application's failure to properly enforce privileges to various MembershipTool methods. This issue allows remote, anonymous attackers to modify and...

CVE-2006-1711

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

CVE-2006-1711

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

Code injection

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

CVE-2006-1711

CVE-2006-1711 affects Plone 2.0.5, 2.1.2, and 2.5-beta1; the issue is failure to restrict access to changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword, enabling remote modification of portraits. Root cause: inadequate access controls on those methods. Exploitation details are n...

CVE-2006-1711

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

CVE-2006-1711: Undefined Security Weakness

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

PT-2006-1028

Name of the Vulnerable Software and Affected Versions: Plone versions 2.0.5, 2.1.2, and 2.5-beta1 Description: The issue allows remote attackers to modify portraits due to a lack of access restriction to certain methods. Specifically, the methods changeMemberPortrait, deletePersonalPortrait, and...