CVE-2008-1394

Plone CMS before v3 stores a base64-encoded form of the username and password in the __ac cookie for all user accounts, enabling credential exposure via network sniffing. Root cause: insecure cookie handling that reveals credentials. Impact: remote attackers could gain access by sniffing traffic....

CVE-2008-1393

Plone CMS before version 3 (e.g., 3.0.5 and likely other 3.x) stores a base64-encoded form of the admin username and password in the __ac cookie, enabling an attacker who can sniff network traffic to obtain administrative privileges. Connected advisories (GHSA-593C-J348-F3GV; OSV) corroborate imp...

CVE-2008-1396

CVE-2008-1396 affects Plone CMS 3.x . The issue is in how Plone computes the HMAC-SHA1 value for the authentication cookie: it uses invariant data (a client username and a server secret), which can enable remote attackers to gain permanent access to a user account by sniffing network traffic. The...

CVE-2008-0164

The CVE-2008-0164 entry concerns Plone CMS 3.0.5 and 3.0.6, describing two CSRF vulnerabilities: (1) remote attackers can add arbitrary accounts via the join_form page and (2) change group privileges via the prefs_groups_overview page. The NVD entry assigns a base score of 4.3 (Medium) with Netwo...

CVE-2008-1395

CVE-2008-1395 affects the Plone CMS. The vulnerability arises because Plone does not record users’ authentication states and implements logout purely on the client side, which can allow context-dependent attackers to reuse a logged-out session. The available documents describe the issue and its i...