Show filters
32 Total Results
Displaying 31-32 of 32
Sort by:
Attacker Value
Unknown
CVE-2013-4192
Disclosure Date: March 11, 2014 (last updated October 05, 2023)
sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors.
0
Attacker Value
Unknown
CVE-2013-4200
Disclosure Date: January 21, 2014 (last updated November 08, 2023)
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.
0
