GHSA-84JM-CPC5-C7G7 Plone XSS in Zope ZMI

Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the objids:tokens parameter...

Plone vulnerable to privilege escalation in WebDAV

Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors...

GHSA-V4VJ-49M5-WJHW Plone vulnerable to unauthorized disclosure of site content

Plone versions 3.3 before 4.3.10 and 5.x before 5.0.5 allow remote attackers to obtain information about the ID of sensitive content via unspecified vectors...

GHSA-QQGJ-22GR-73VX Plone vulnerable to privilege escalation in WebDAV

Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors...

Plone vulnerable to unauthorized disclosure of site content

Plone versions 3.3 before 4.3.10 and 5.x before 5.0.5 allow remote attackers to obtain information about the ID of sensitive content via unspecified vectors...

GHSA-6H8X-73FX-Q2H9 Chameleon in Plone allows Authentication Bypass

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

Chameleon in Plone allows Authentication Bypass

Chameleon five.pt in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates...

GHSA-3V28-9JJP-4G5W Plone Privilege Escalation Vulnerability

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

Plone Privilege Escalation Vulnerability

Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors...

GHSA-VF8G-M3VQ-6P4P Plone Cross-site Scripting Vulnerability

Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into a specially crafted url containing script, %3Cscript, javascript:, or javascript%3A, Cross-site Scripting can be achieved...

Plone Cross-site Scripting Vulnerability

Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into a specially crafted url containing script, %3Cscript, javascript:, or javascript%3A, Cross-site Scripting can be achieved...

Plone unauthorized member addition vulnerability

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator...

GHSA-984M-RJ28-8C6X Plone unauthorized member addition vulnerability

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator...

GHSA-FQ9R-8JPM-2222 Plone Header Injection

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses...

Plone Header Injection

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses...

Plone vulnerable to cross-site request forgery

Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...

GHSA-P3QM-44CF-F8QX Plone vulnerable to cross-site request forgery

Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...

Products.CMFPlone XSS in profile home_page property

A member of the Plone site could set javascript in the homepage property of their profile, and have this executed when a visitor clicks the home page link on the author page...

GHSA-859J-668V-MRR6 Products.CMFPlone XSS in profile home_page property

A member of the Plone site could set javascript in the homepage property of their profile, and have this executed when a visitor clicks the home page link on the author page...

Products.CMFPlone Open Redirect Vulnerability

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...