Vulnerabilities > Plone > Plone
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-09-30 | CVE-2012-5491 | Information Exposure vulnerability in Plone z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id. | 4.3 |
| 2014-09-30 | CVE-2012-5490 | Cross-Site Scripting vulnerability in Plone Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2014-09-30 | CVE-2012-5489 | Permissions, Privileges, and Access Controls vulnerability in multiple products The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors. | 6.5 |
| 2014-09-30 | CVE-2012-5487 | Permissions, Privileges, and Access Controls vulnerability in Plone The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing. | 8.5 |
| 2014-05-02 | CVE-2013-7061 | Permissions, Privileges, and Access Controls vulnerability in Plone Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API. | 5.5 |
| 2014-05-02 | CVE-2013-7060 | Information Exposure vulnerability in Plone Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope. | 5.0 |
| 2014-03-11 | CVE-2013-4199 | Improper Input Validation vulnerability in Plone (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed). | 3.5 |
| 2014-03-11 | CVE-2013-4198 | Permissions, Privileges, and Access Controls vulnerability in Plone mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality. | 4.0 |
| 2014-03-11 | CVE-2013-4197 | Improper Input Validation vulnerability in Plone member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors. | 5.5 |
| 2014-03-11 | CVE-2013-4196 | Permissions, Privileges, and Access Controls vulnerability in Plone The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request. | 5.0 |