Show filters
22 Total Results
Displaying 11-20 of 22
Sort by:
Attacker Value
Unknown
CVE-2016-7136
Disclosure Date: March 07, 2017 (last updated November 26, 2024)
z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.
0
Attacker Value
Unknown
CVE-2016-7140
Disclosure Date: March 07, 2017 (last updated November 26, 2024)
Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
0
Attacker Value
Unknown
CVE-2016-7138
Disclosure Date: March 07, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
0
Attacker Value
Unknown
CVE-2016-4041
Disclosure Date: February 24, 2017 (last updated November 26, 2024)
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors.
0
Attacker Value
Unknown
CVE-2016-4042
Disclosure Date: February 24, 2017 (last updated November 26, 2024)
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors.
0
Attacker Value
Unknown
CVE-2016-7147
Disclosure Date: February 04, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.
0
Attacker Value
Unknown
CVE-2013-7060
Disclosure Date: May 02, 2014 (last updated October 05, 2023)
Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope.
0
Attacker Value
Unknown
CVE-2013-7061
Disclosure Date: May 02, 2014 (last updated October 05, 2023)
Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.
0
Attacker Value
Unknown
CVE-2011-4462
Disclosure Date: December 30, 2011 (last updated October 04, 2023)
Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
0
Attacker Value
Unknown
CVE-2011-3587
Disclosure Date: October 10, 2011 (last updated October 04, 2023)
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.
0
