PT-2021-20171

Name of the Vulnerable Software and Affected Versions Plone versions through 5.2.4 Description The issue allows for cross-site scripting XSS attacks via the inline diff methods in Products.CMFDiffTool. This can potentially lead to malicious script execution on the client-side. Recommendations For...

PT-2021-20170

Name of the Vulnerable Software and Affected Versions Plone versions through 5.2.4 Description The issue allows stored XSS attacks by uploading an SVG or HTML document, which can be exploited by a Contributor. Recommendations For versions through 5.2.4, update to a version that contains a fix for...

Plone 代码问题漏洞

Plone is the Plone Foundation's open source content management system running on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An attacker can exploit this vulnerability to initiate a server-side request using the lxml parser...

Plone 代码问题漏洞

Plone is an open source content management system CMS built on the Zope application server. A server-side request forgery vulnerability exists in Plone 5.2.4 and earlier versions. An authenticated remote attacker can exploit this vulnerability to read a line in a file...

Plone 跨站脚本漏洞

Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the inlinedi...

CVE-2021-33511: Server-Side Request Forgery (SSRF)

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...

Plone 跨站脚本漏洞

Plone is the industry's leading open source CMS system for content management, document management and knowledge management. A stored cross-site scripting vulnerability exists in Plone 5.2.4 and earlier versions. The vulnerability can be exploited by uploading SVG or HTML documents to conduct...

CVE-2021-33508: Improper Neutralization of Input During Web Page Generation

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...

CVE-2021-33512: Improper Neutralization of Input During Web Page Generation

Plone through 5.2.4 allows stored XSS attacks by a Contributor by uploading an SVG or HTML document...

PT-2021-20164

Name of the Vulnerable Software and Affected Versions Zope Products.CMFCore versions prior to 2.5.1 Zope Products.PluggableAuthService versions prior to 2.6.2 Plone versions prior to 5.2.4 Description The issue allows Reflected XSS. This means an attacker can inject malicious code into a website,...

PT-2021-20169

Name of the Vulnerable Software and Affected Versions Plone versions prior to 5.2.5 Description The issue allows for Server-Side Request Forgery SSRF via the lxml parser. This affects various components including Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming,...

CVE-2021-33507: Improper Neutralization of Input During Web Page Generation

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS...

Plone cross-site scripting vulnerability (CNVD-2021-37279)

Plone is a foreign open source CMS system suitable for enterprise-level applications. A cross-site scripting vulnerability exists in the user full name attribute and file upload functionality in Plone CMS versions prior to 5.2.4. The vulnerability stems from user input that is not properly encode...

CVE-2021-3313

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

CVE-2021-3313

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

PYSEC-2021-78

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

CVE-2021-3313

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

Cross site scripting

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

PYSEC-2021-78

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...

CVE-2021-3313

Plone CMS affected: versions up to and including 5.2.4. The issue is a stored XSS in the user fullname attribute and file upload handling, caused by input not being properly encoded when echoed back. Impact is that an attacker can inject JavaScript that executes in the victim’s browser when inter...