CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-23756
https://notcve.org/view.php?id=CVE-2024-23756
The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them. Los métodos HTTP PUT y DELETE están habilitados en la versión 5.2.13 (5221) oficial de Docker de Plone, lo que permite a atacantes no autenticados ejecutar acciones peligrosas como cargar archivos al servidor o eliminarlos. • https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23756 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-23054
https://notcve.org/view.php?id=CVE-2024-23054
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm). Un problema en el software de código abierto Plone Docker Official Image 5.2.13 (5221) que podría permitir la ejecución remota de código debido a que un paquete listado en ++plone++static/components no existe en el índice de paquetes públicos (npm). • http://plone.com http://ploneorg.com https://github.com/c0d3x27/CVEs/blob/main/CVE-2024-23054/README.md • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-23055
https://notcve.org/view.php?id=CVE-2024-23055
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers. Un problema en el software de código abierto Plone Docker Official Image 5.2.13 (5221) permite la ejecución remota de código mediante una validación incorrecta de la entrada por parte de los encabezados HOST. • http://plone.com http://ploneorg.com https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23055 •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0669 – Cross-Frame Scripting (XFS) on Plone CMS
https://notcve.org/view.php?id=CVE-2024-0669
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element. Se ha encontrado una vulnerabilidad de Cross-Frame Scripting en Plone CMS que afecta a la versión inferior a 6.0.5. Un atacante podría almacenar una URL maliciosa para que la abra un administrador y ejecutar un elemento iframe malicioso. • https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-plone-cms • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-42457 – plone.rest vulnerable to Denial of Service when ++api++ is used many times
https://notcve.org/view.php?id=CVE-2023-42457
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache). plone.rest permite a los usuarios utilizar verbos HTTP como GET, POST, PUT, DELETE, etc. en Plone. • http://www.openwall.com/lists/oss-security/2023/09/22/2 https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7 https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302 https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •