PYSEC-2018-72

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

Format string

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

PYSEC-2018-71

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

PYSEC-2018-72

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

CVE-2017-1000481

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

CVE-2017-1000481

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

CVE-2017-1000481

The CVE-2017-1000481 issue affects Plone 2.5–5.1rc1 where a login flow uses a came_from parameter to redirect after login. A malformed/crafted link can lead users to an attacker’s site or allow attacker-controlled JavaScript execution; Plone’s isURLInPortal checks mitigate, but additional bypasse...

CVE-2017-1000482

CVE-2017-1000482 affects Plone 2.5–5.1rc1. An attacker could inject JavaScript into the home_page property of a user’s profile, causing script execution when a visitor clicks the home page link on the author page. Root cause: storing executable JS in the home_page field. Impact reported as XSS to...

CVE-2017-1000483

Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...

CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

CVE-2017-1000481

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

CVE-2017-1000483

CVE-2017-1000483 affects Plone 2.5–5.1rc1 where private content can be accessed via str.format in through-the-web templates and scripts. The issue stems from the format method exposure, with the hotfix originally addressing this and noting the format method is from Python 2.6, making the fix rele...

PT-2018-5247

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows a member of the Plone site to set JavaScript in the home page property of their profile. This JavaScript is executed when a visitor clicks the home page link on the author page...

CVE-2017-1000484: URL Redirection to Untrusted Site

By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login fo...

CVE-2017-1000482: Improper Neutralization of Input During Web Page Generation

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...

PT-2018-5246

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows an attacker to potentially trick users into accessing malicious sites or executing attacker-controlled JavaScript after logging in, by exploiting the redirect mechanism that uses t...

CVE-2017-1000481: URL Redirection to Untrusted Site

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'camefrom' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafte...

PT-2018-5249

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows an attacker to redirect users to their own website by linking to a specific URL in Plone with a parameter. Although this is not severe on its own, it can be combined with another...

PT-2018-5248

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows accessing private content via str.format in through-the-web templates and scripts. This improves an earlier hotfix, specifically relevant for Plone 4 and 5 due to the introduction ...