Show filters
61 Total Results
Displaying 21-30 of 61
Sort by:
Attacker Value
Unknown
CVE-2012-5490
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
0
Attacker Value
Unknown
CVE-2012-5493
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.
0
Attacker Value
Unknown
CVE-2012-5486
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.
0
Attacker Value
Unknown
CVE-2012-5507
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
0
Attacker Value
Unknown
CVE-2012-5494
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."
0
Attacker Value
Unknown
CVE-2012-5499
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.
0
Attacker Value
Unknown
CVE-2012-5487
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.
0
Attacker Value
Unknown
CVE-2012-5501
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
0
Attacker Value
Unknown
CVE-2012-5502
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors.
0
Attacker Value
Unknown
CVE-2012-5489
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
0
