1800 matches found
Privilege escalation
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT overwrite some content without needing write permission...
PYSEC-2020-89
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking...
Cross site scripting
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...
Default credentials
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking...
CVE-2020-7936
An open redirect on the login form and possibly other places in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site...
CVE-2020-7936
An open redirect on the login form and possibly other places in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site...
CVE-2020-7936
CVE-2020-7936 describes an open redirect in Plone 4.0–5.2.1 on the login form (and possibly other entry points). The vulnerability allows an attacker to craft a link that, after following and possibly after login, redirects the user to the attacker's site. Affected software is Plone (4.0–5.2.1); ...
CVE-2020-7937
CVE-2020-7937 is an XSS vulnerability in the title field of Plone 5.0–5.2.1. The issue allows users with a certain privilege level to inject JavaScript that executes for other site visitors. The core vulnerability is in the title field handling, enabling stored or reflected XSS depending on conte...
CVE-2020-7937
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...
CVE-2020-7937
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...
CVE-2020-7938
plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level...
CVE-2020-7938
Plone 5.2.0–5.2.1 with plone.restapi contains a privilege-escalation flaw that lets users with a certain privilege level elevate to the highest level. The issue, tracked as CVE-2020-7938, affects the REST API component and can impact confidentiality, integrity, and availability. The connected sou...
CVE-2020-7938
plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level...
CVE-2020-7939
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
CVE-2020-7939
CVE-2020-7939 is a Plone/DTML SQL injection vulnerability, affecting Plone 4.0–5.2.1 (problem in Zope). The connected documents describe the issue as SQL injection in DTML or in connection objects, enabling unwanted SQL queries. No explicit exploit status is provided in the documents, and the mat...
CVE-2020-7939
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...
CVE-2020-7940
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking...
CVE-2020-7940
Plone 4.3–5.2.0 is affected by CVE-2020-7940 due to missing password strength checks on certain forms, enabling weak passwords and easier cracking. Root cause: insufficient validation of password strength in the affected forms. Impact: weak passwords could be set by users, reducing account securi...