Show filters
111 Total Results
Displaying 71-80 of 111
Sort by:
Attacker Value
Unknown
CVE-2012-5488
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.
0
Attacker Value
Unknown
CVE-2012-5505
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.
0
Attacker Value
Unknown
CVE-2012-5491
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
0
Attacker Value
Unknown
CVE-2012-5498
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.
0
Attacker Value
Unknown
CVE-2012-5492
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.
0
Attacker Value
Unknown
CVE-2013-7060
Disclosure Date: May 02, 2014 (last updated October 05, 2023)
Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope.
0
Attacker Value
Unknown
CVE-2013-7061
Disclosure Date: May 02, 2014 (last updated October 05, 2023)
Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.
0
Attacker Value
Unknown
CVE-2013-4188
Disclosure Date: March 11, 2014 (last updated October 05, 2023)
traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources."
0
Attacker Value
Unknown
CVE-2013-4190
Disclosure Date: March 11, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
0
Attacker Value
Unknown
CVE-2013-4189
Disclosure Date: March 11, 2014 (last updated October 05, 2023)
Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.
0
