CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0669 – Cross-Frame Scripting (XFS) on Plone CMS
https://notcve.org/view.php?id=CVE-2024-0669
18 Jan 2024 — A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element. Se ha encontrado una vulnerabilidad de Cross-Frame Scripting en Plone CMS que afecta a la versión inferior a 6.0.5. Un atacante podría almacenar una URL maliciosa para que la abra un administrador y ejecutar un elemento iframe malicioso. • https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-plone-cms • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 9.0EPSS: 0%CPEs: 52EXPL: 1CVE-2021-33926
https://notcve.org/view.php?id=CVE-2021-33926
17 Feb 2023 — An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet. • https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-33507
https://notcve.org/view.php?id=CVE-2021-33507
21 May 2021 — Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. Zope Products.CMFCore. versiones anteriores a 2.5.1, y Products.PluggableAuthService versiones anteriores a 2.6.2, como es usado en Plone versiones hasta 5.2.4, y otros productos, permiten un ataque de tipo XSS Reflejado • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33508
https://notcve.org/view.php?id=CVE-2021-33508
21 May 2021 — Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de un nombre completo que es manejado inapropiadamente durante el renderizado de la pestaña de propiedad de un elemento de contenido • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33509
https://notcve.org/view.php?id=CVE-2021-33509
21 May 2021 — Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos diseñar E/S de discos por medio de argumentos de palabras clave diseñados a la transformación ReStructuredText en un script de Python • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33510
https://notcve.org/view.php?id=CVE-2021-33510
21 May 2021 — Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos conducir ataques de tipo SSRF por medio de una URL de evento para leer una línea de un archivo • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33511
https://notcve.org/view.php?id=CVE-2021-33511
21 May 2021 — Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel. Plone versiones hasta 5.2.4, permite un ataque de tipo SSRF por medio del analizador lxml. Esto afecta los temas Diazo, esquemas Dexterity TTW y modeladores en plone.app.theming, plone.app.dexterity y plone.supermodel • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33512
https://notcve.org/view.php?id=CVE-2021-33512
21 May 2021 — Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS almacenado (por un Colaborador) al cargar un documento SVG o HTML • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33513
https://notcve.org/view.php?id=CVE-2021-33513
21 May 2021 — Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de los métodos inline_diff en Products.CMFDiffTool • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-32633 – Remote Code Execution via traversal in TAL expressions
https://notcve.org/view.php?id=CVE-2021-32633
21 May 2021 — Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict add... • http://www.openwall.com/lists/oss-security/2021/05/21/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •