CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0669 – Cross-Frame Scripting (XFS) on Plone CMS
https://notcve.org/view.php?id=CVE-2024-0669
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element. Se ha encontrado una vulnerabilidad de Cross-Frame Scripting en Plone CMS que afecta a la versión inferior a 6.0.5. Un atacante podría almacenar una URL maliciosa para que la abra un administrador y ejecutar un elemento iframe malicioso. • https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-plone-cms • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 8.8EPSS: 0%CPEs: 52EXPL: 1CVE-2021-33926
https://notcve.org/view.php?id=CVE-2021-33926
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet. • https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf https://plone.org/security/hotfix/20210518 https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-33507
https://notcve.org/view.php?id=CVE-2021-33507
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. Zope Products.CMFCore. versiones anteriores a 2.5.1, y Products.PluggableAuthService versiones anteriores a 2.6.2, como es usado en Plone versiones hasta 5.2.4, y otros productos, permiten un ataque de tipo XSS Reflejado • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33508
https://notcve.org/view.php?id=CVE-2021-33508
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de un nombre completo que es manejado inapropiadamente durante el renderizado de la pestaña de propiedad de un elemento de contenido • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33509
https://notcve.org/view.php?id=CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos diseñar E/S de discos por medio de argumentos de palabras clave diseñados a la transformación ReStructuredText en un script de Python • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script • CWE-732: Incorrect Permission Assignment for Critical Resource •