GHSA-35RG-466W-77H3 Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

Server-Side Request Forgery in Plone

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

GHSA-GC9G-67CQ-P7V4 Server-Side Request Forgery in Plone

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

Server-Side Request Forgery in Plone

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

GHSA-4MG4-WVMX-5332 Server-Side Request Forgery in Plone

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

Incorrect Permission Assignment for Critical Resource in Plone

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

GHSA-HM2P-FHWX-9285 Incorrect Permission Assignment for Critical Resource in Plone

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

GHSA-RMPV-RCP6-V8WC Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

GHSA-HM2H-F456-6J88 Cross-site scripting in Plone

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

Cross-site scripting in Plone

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

GHSA-FJ67-W3M4-RFMP Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Plone CMS <= 5.2.4 Multiple Vulnerabilities

Plone CMS is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cross-Site Scripting (XSS)

plone is vulnerable to cross-site scripting. The vulnerability exists due to the mishandling of the full name during rendering of the ownership tab of a content item...

Cross-Site Scripting (XSS)

plone is vulnerable to cross-site scripting. The package fails to sanitize the user fullname field allowing attackers to execute arbitrary JavaScript in a victim's browser...

Plone server-side request forgery vulnerability

Plone is the Plone Foundation's open source content management system running on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An attacker can exploit this vulnerability to initiate a server-side request using the lxml parser...

Server Side Request Forgery

plone is vulnerable to server side request forgery. An attacker is able to submit requests on behalf of the server via the lxml parser...

Information Disclosure

plone is vulnerable to information disclosure. A remotely authenticated manager is able to perform disk I/O through malicious keyword arguments to ReStructuredText transform...