Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

plone

101 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
101 · 1 high, 2 medium
Registry
PyPI

Advisories 101

  • CVE-2024-22889Medium 5.5

    Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a…

    Affected: through 6.0.9.

  • CVE-2024-0669Medium 6.3

    Cross-Frame Scripting (XFS) on Plone CMS

    Affected: fixed in 6.0.7.

  • An issue in Plone CMS v.

    Affected: from 4.3, fixed in 5.2.5.

  • In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT…

    Affected: from 5.0, fixed in 5.2.5; from 5.0, through 5.2.4.

  • Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products…

    Affected: through 5.2.4; fixed in 5.2.5.

  • Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.

    Affected: fixed in 5.2.5; through 5.2.4.

  • Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText…

    Affected: fixed in 5.2.5.

  • Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.

    Affected: through 5.2.4; fixed in 5.2.5.

  • Plone though 5.2.4 allows SSRF via the lxml parser.

    Affected: through 5.2.4; fixed in 5.2.5.

  • Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.

    Affected: through 5.2.4; fixed in 5.2.5.

  • Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.

    Affected: through 5.2.4; fixed in 5.2.5.

  • Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload…

    Affected: fixed in 5.2.4.

  • A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title"…

    Affected: through 5.2.3.

  • Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata…

    Affected: fixed in 5.2.3.

  • Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

    Affected: fixed in 5.2.3.

Show all 101 advisoriesShow fewer advisories

  • Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

    Affected: fixed in 5.2.3.

  • An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone…

    Affected: from 4.0, fixed in 4.3.20; from 5.0rc1, fixed in 5.1.7; from 5.2.0, fixed in 5.2.2; from 4.0, fixed in 5.2.2.

  • An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be…

    Affected: from 5.0, through 5.2.1; from 5.0, fixed in 5.2.2.

  • plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.

    Affected: from 5.2.0, fixed in 5.2.2.

  • SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries.

    Affected: from 4.0, through 5.2.1; from 4.0, fixed in 5.2.2.

  • Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.

    Affected: from 4.3, fixed in 4.3.20; from 5.0rc1, fixed in 5.1.7; from 5.2.0, fixed in 5.2.2; from 4.3, fixed in 5.2.1.

  • A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without…

    Affected: from 4.3, through 5.2.1; from 4.3, fixed in 5.2.2.

  • Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through…

    Affected: from 3.3, fixed in 4.0a1; from 4.0, fixed in 4.0.10; from 4.1, fixed in 4.2a1; from 4.2, fixed in 4.3a1; from 4.3, fixed in 4.3.3; from 3.3, fixed in 3.3.6; from 4.0, fixed in 4.0.9; from 4.1, fixed in 4.1.6; from 4.3, fixed in 4.3.2.

  • By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website.

    Affected: from 2.5, fixed in 5.1.0; from 2.5, fixed in 4.3.16; from 5.0.0, fixed in 5.1.0.

  • Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1.

    Affected: from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0; from 2.5, fixed in 4.3.16; from 5.0, fixed in 5.1.0.

  • A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor…

    Affected: from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0; from 2.5a1, fixed in 4.3.16; from 5.0a1, fixed in 5.1.0.

  • When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the…

    Affected: from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0; from 2.5, fixed in 4.3.16; from 5, fixed in 5.1.0.

  • Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

    Affected: fixed in 5.0a1.

  • Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.

    Affected: from 3.3, fixed in 4.0a1.

  • Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7…

    Affected: from 3.3, fixed in 4.0a1; from 4.0, fixed in 4.1a1; from 4.1, fixed in 4.2a1; from 4.2, fixed in 4.3a1; from 4.3, fixed in 4.3.7; from 5.0a1, fixed in 5.0rc2; from 3.3, fixed in 3.3.7; from 4.0, fixed in 4.0.11; from 4.1, fixed in 4.1.7; from 4.2, fixed in 4.2.8; from 4.3, fixed in 4.3.7; versions 5.0rc1.

  • Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote…

    Affected: from 3.3, fixed in 4.0a1; from 4.0, fixed in 4.1a1; from 4.1, fixed in 4.2a1; from 4.2, fixed in 4.3a1; from 4.3, fixed in 4.3.7; from 5.0a1, fixed in 5.0rc2; from 3.3, through 3.3.6; from 4.0a1, through 4.0.10; from 4.1a1, through 4.1.6; from 4.2a1, through 4.2.7; from 4.3a1, through 4.3.6; versions 5.0rc1.

  • Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive…

    Affected: from 4.0, fixed in 4.3.12; from 5.1a1, fixed in 5.1b1; from 5.0rc1, fixed in 5.0.7; fixed in 4.3.12; from 5.0a1, fixed in 5.0.7.

  • Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x…

    Affected: from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1; from 5.0a1, fixed in 5.0.7; from 3.3a1, fixed in 4.3.12.

  • Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x…

    Affected: from 5.0, fixed in 5.0.6; from 4.0a1, fixed in 4.3.12; from 3.3, through 3.3.6; from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1.

  • Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x…

    Affected: from 5.0.0, through 5.0.6; from 4.0.0, through 4.3.11; from 3.3.0, through 3.3.6; from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1.

  • Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers…

    Affected: from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 3.3, fixed in 4.0a1; from 5.0, through 5.0.6; from 4.0, through 4.3.11; from 3.3, through 3.3.6.

  • z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a…

    Affected: from 5.0.0, through 5.0.6; from 4.0.0, through 4.3.11; from 5.0, fixed in 5.0.7; from 4.2, fixed in 4.3.12.

  • Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary…

    Affected: from 5.0, fixed in 5.0.7; from 4.2, fixed in 4.3.12; from 5.0, fixed in 5.0.7; from 4.2, fixed in 4.3.12.

  • Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions…

    Affected: from 5.0rc1, through 5.0.4; versions 5.1a1; from 5.0rc1, fixed in 5.1a2.

  • Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.

    Affected: from 3.3, fixed in 5.1a2; from 5.0, fixed in 5.0.5; from 3.3, fixed in 4.3.10.

  • Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers…

    Affected: from 3.3, fixed in 4.3.10; from 5.0, fixed in 5.0.5; from 5.1a1, fixed in 5.1a2; from 4.0, fixed in 5.1a2.

  • Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and…

    Affected: fixed in 4.3.12; from 5.0, fixed in 5.0.7; from 4.0, fixed in 4.3.12; from 5.0, fixed in 5.0.7.

  • Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which…

    Affected: from 3.2.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the…

    Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; from 3.2.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1.

  • python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a1, fixed in 4.3b1.

  • atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

    Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption)…

    Affected: from 4.0, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.

    Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.

    Affected: fixed in 3.3.6; fixed in 4.0.

  • python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to…

    Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3…

    Affected: from 3.2.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with…

    Affected: fixed in 4.2.3; from 4.3a0, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject…

    Affected: from 3.3.2, fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3.

  • registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors…

    Affected: fixed in 4.2.3; from 4.3a1, fixed in 4.3b1; fixed in 4.2.3; from 4.3a0, fixed in 4.3b1.

  • Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive…

    Affected: from 3.3b1, fixed in 4.3.3; from 3.3, fixed in 4.3.3.

  • Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to…

    Affected: from 3.3, fixed in 4.3.3.

  • (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 4.3, fixed in 4.3.2; from 4.2, fixed in 4.2.6; from 2.1, fixed in 4.1.1.

  • mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, through 4.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, through 4.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 4.3, fixed in 4.3.2; from 4.2, fixed in 4.2.6; from 2.1, fixed in 4.1.1.

  • The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1…

    Affected: from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2; from 2.1, fixed in 4.1.1; from 4.2, fixed in 4.2.6; from 4.3, fixed in 4.3.2.

  • Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably…

    Affected: fixed in 4.1.4.

  • The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from…

    Affected: from 4.0, fixed in 4.0.10; from 4.1, fixed in 4.1.1; from 4.2a1, fixed in 4.2a3; from 4.0, fixed in 4.0.10; from 4.1, fixed in 4.1.1; from 4.2a1, fixed in 4.2a3.

  • Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers…

    Affected: fixed in 2.5.3.

  • Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2)…

    Affected: from 3.3.2, fixed in 3.3.6.

  • plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified…

    Affected: fixed in 4.1.1; from 4.0.1, fixed in 4.0.6; from 4.1.0, fixed in 4.1.1.

  • Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote…

    Affected: fixed in 4.1.1; from 3.3.2, fixed in 3.3.6; from 4.0a0, fixed in 4.0.6; from 4.1a0, fixed in 4.1.1.

  • Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a…

    Affected: fixed in 4.1.1.

  • Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain…

    Affected: from 2.5, fixed in 4.0.4; fixed in 4.0.1.

  • Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to…

    Affected: from 2.1, fixed in 3.3.6; fixed in 3.3.5.

  • The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows…

    Affected: from 3.0, through 3.1; through 3.2; through 3.3; through 3.4; through 3.5.

  • Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web…

    Affected: fixed in 3.0.4.

  • Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication…

    Affected: through 3.1.7.

  • Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it…

    Affected: fixed in 3.0.

  • Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the…

    Affected: fixed in 3.0.

  • Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary…

    Affected: fixed in 3.1.

  • Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled…

    Affected: from 2.5, fixed in 2.5.5; from 3.0, fixed in 3.0.3; from 2.5, fixed in 2.5.5; from 3.0, fixed in 3.0.3.

  • Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to…

    Affected: from 2.5, fixed in 2.5.2.

  • Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the…

    Affected: from 2.5, fixed in 2.5.1.

  • Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3)…

    Affected: fixed in 2.0.6; from 2.1.0; fixed in 2.0.6; from 2.1.0, through 2.1.2; versions 2.5-beta1.