CVE-2017-1000483

CVE-2017-1000483 affects Plone 2.5–5.1rc1 where private content can be accessed via str.format in through-the-web templates and scripts. The issue stems from the format method exposure, with the hotfix originally addressing this and noting the format method is from Python 2.6, making the fix rele...

CVE-2017-1000481

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

CVE-2017-1000481

The CVE-2017-1000481 issue affects Plone 2.5–5.1rc1 where a login flow uses a came_from parameter to redirect after login. A malformed/crafted link can lead users to an attacker’s site or allow attacker-controlled JavaScript execution; Plone’s isURLInPortal checks mitigate, but additional bypasse...

Plone Design Vulnerability

Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A design...

Zope Management Interface and Plone Cross-Site Request Forgery Vulnerabilities

Plone is the United States Plone Foundation's set of free and open source content management system CMS built on the application server Zope. Zope Management Interface ZMI is one of the management interface. A cross-site request forgery vulnerability exists in Zope Management Interface versions...

Plone Cross-Site Scripting Vulnerability

Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A cross-sit...

Plone header injection vulnerability

Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. A security...

CVE-2015-7293

Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...

PYSEC-2017-51

Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...

PYSEC-2017-51

Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...

CVE-2015-7293

The CVE concerns multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface (ZMI) 4.3.7 and earlier, and Plone before 5.x. The affected component is the ZMI/Plone web interfaces built on Zope, with the root cause being CSRF weaknesses that could allow unauthorized act...

CVE-2015-7293

Multiple cross-site request forgery CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x...

Code injection

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses...

PYSEC-2017-52

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator...

PYSEC-2017-54

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses...

Cross site scripting

Cross-site scripting XSS vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1...

PYSEC-2017-53

Cross-site scripting XSS vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1...

CVE-2015-7318

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses...

CVE-2015-7315

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator...