Vulnerabilities > Plone > Plone > 2.0.3
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2014-09-30 | CVE-2012-5489 | Permissions, Privileges, and Access Controls vulnerability in multiple products The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors. | 6.5 |
2014-09-30 | CVE-2012-5487 | Permissions, Privileges, and Access Controls vulnerability in Plone The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing. | 8.5 |
2011-12-30 | CVE-2011-4462 | Improper Input Validation vulnerability in Plone Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. | 5.0 |
2011-08-05 | CVE-2011-1340 | Cross-Site Scripting vulnerability in Plone Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject. | 4.3 |
2008-10-15 | CVE-2008-4571 | Cross-Site Scripting vulnerability in Plone Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag. | 4.3 |