CVE-2020-7941

CVE-2020-7941 is a privilege-escalation flaw in Plone’s plone.app.contenttypes (versions 4.3–5.2.1) that allows a user to PUT/overwrite content without write permission. The issue affects the content-overwrite pathway and can impact confidentiality, integrity, and availability as described in the...

CVE-2020-7941

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT overwrite some content without needing write permission...

Authorization Bypass

plone.app.contenttypes is vulnerable to authorization bypass. The vulnerability exists as a user might be able to use a PUT request to overwrite content without requiring the write permission...

PT-2020-19861

Name of the Vulnerable Software and Affected Versions Plone versions 4.0 through 5.2.1 Description The issue allows users to perform unwanted SQL queries due to SQL Injection in DTML or in connection objects. This problem is related to Zope. Recommendations For Plone versions 4.0 through 5.2.1,...

CVE-2020-7938: Undefined Security Weakness

plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level...

CVE-2020-7937: Improper Neutralization of Input During Web Page Generation

An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...

CVE-2020-7939: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. This is a problem in Zope...

PT-2020-19860

Name of the Vulnerable Software and Affected Versions Plone versions 5.2.0 through 5.2.1 Description The issue allows users with a certain privilege level to escalate their privileges up to the highest level. Recommendations For Plone versions 5.2.0 through 5.2.1, update to a version that contain...

CVE-2020-7940: Weak Password Requirements

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking...

PT-2020-19859

Name of the Vulnerable Software and Affected Versions Plone versions 5.0 through 5.2.1 Description A cross-site scripting XSS issue exists in the title field, allowing users with a certain privilege level to insert JavaScript code. This code will be executed when other users access the site...

PT-2020-19858

Name of the Vulnerable Software and Affected Versions Plone versions 4.0 through 5.2.1 Description The issue is related to an open redirect on the login form and possibly other areas, allowing an attacker to create a link that redirects to an attacker's site after login. Recommendations For...

PT-2020-19862

Name of the Vulnerable Software and Affected Versions Plone versions 4.3 through 5.2.0 Description The issue is related to missing password strength checks on some forms, allowing users to set weak passwords. This makes it easier for attackers to crack the passwords. Recommendations For Plone...

CVE-2020-7941: Undefined Security Weakness

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT overwrite some content without needing write permission...

CVE-2020-7936: URL Redirection to Untrusted Site

An open redirect on the login form and possibly other places in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site...

PT-2020-1633

Name of the Vulnerable Software and Affected Versions Plone versions 4.3 through 5.2.1 Description The issue is related to a privilege escalation problem in the plone.app.contenttypes package of the Plone content management system. This allows users to overwrite certain content using the PUT meth...

Plone and Zope 'BrowserIdManager.py' Cross-Site Scripting Vulnerability

Zope is Zope's set of Python-based open source object-oriented Web application server . Plone is the United States Plone Foundation's set of free and open source content management system built on Zope CMS. A cross-site scripting vulnerability exists in Plone and Zope that stems from the program...

CVE-2013-7062

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...

PYSEC-2020-218

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...

CVE-2013-7062

Multiple cross-site scripting XSS vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the 1 browseridmanager or 2...