PT-2021-21080

Name of the Vulnerable Software and Affected Versions: Plone versions 5.0 through 5.2.4 Description: The issue affects Editors in the folder contents view, where a Contributor can create a folder with a SCRIPT tag in the description field, leading to XSS. Recommendations: For Plone versions 5.0...

CVE-2021-35959: Improper Neutralization of Input During Web Page Generation

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field...

GHSA-35RG-466W-77H3 Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

Server-Side Request Forgery in Plone

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

GHSA-GC9G-67CQ-P7V4 Server-Side Request Forgery in Plone

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

GHSA-4MG4-WVMX-5332 Server-Side Request Forgery in Plone

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

Server-Side Request Forgery in Plone

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

GHSA-HM2P-FHWX-9285 Incorrect Permission Assignment for Critical Resource in Plone

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

Incorrect Permission Assignment for Critical Resource in Plone

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script...

Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

GHSA-RMPV-RCP6-V8WC Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

GHSA-HM2H-F456-6J88 Cross-site scripting in Plone

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

Cross-site scripting in Plone

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

GHSA-FJ67-W3M4-RFMP Cross-site scripting in Plone

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool...

Plone CMS <= 5.2.4 Multiple Vulnerabilities

Plone CMS is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cross-Site Scripting (XSS)

plone is vulnerable to cross-site scripting. The vulnerability exists due to the mishandling of the full name during rendering of the ownership tab of a content item...

Cross-Site Scripting (XSS)

plone is vulnerable to cross-site scripting. The package fails to sanitize the user fullname field allowing attackers to execute arbitrary JavaScript in a victim's browser...

Plone server-side request forgery vulnerability

Plone is the Plone Foundation's open source content management system running on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An attacker can exploit this vulnerability to initiate a server-side request using the lxml parser...