CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33508
https://notcve.org/view.php?id=CVE-2021-33508
21 May 2021 — Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de un nombre completo que es manejado inapropiadamente durante el renderizado de la pestaña de propiedad de un elemento de contenido • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33509
https://notcve.org/view.php?id=CVE-2021-33509
21 May 2021 — Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos diseñar E/S de discos por medio de argumentos de palabras clave diseñados a la transformación ReStructuredText en un script de Python • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33510
https://notcve.org/view.php?id=CVE-2021-33510
21 May 2021 — Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos conducir ataques de tipo SSRF por medio de una URL de evento para leer una línea de un archivo • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33511
https://notcve.org/view.php?id=CVE-2021-33511
21 May 2021 — Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel. Plone versiones hasta 5.2.4, permite un ataque de tipo SSRF por medio del analizador lxml. Esto afecta los temas Diazo, esquemas Dexterity TTW y modeladores en plone.app.theming, plone.app.dexterity y plone.supermodel • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33512
https://notcve.org/view.php?id=CVE-2021-33512
21 May 2021 — Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS almacenado (por un Colaborador) al cargar un documento SVG o HTML • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33513
https://notcve.org/view.php?id=CVE-2021-33513
21 May 2021 — Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de los métodos inline_diff en Products.CMFDiffTool • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-32633 – Remote Code Execution via traversal in TAL expressions
https://notcve.org/view.php?id=CVE-2021-32633
21 May 2021 — Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict add... • http://www.openwall.com/lists/oss-security/2021/05/21/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3313
https://notcve.org/view.php?id=CVE-2021-3313
20 May 2021 — Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload. Plone CMS hasta versión 5.2.4 presenta una vulnerabilidad de tipo Cro... • http://www.openwall.com/lists/oss-security/2021/05/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 3CVE-2021-29002
https://notcve.org/view.php?id=CVE-2021-29002
24 Mar 2021 — A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter. Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en Plone CMS versión 5.2.3 en el site-controlpanel por medio del parámetro "form.widgets.site_title" • https://github.com/miguelc49/CVE-2021-29002-1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21336 – Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
https://notcve.org/view.php?id=CVE-2021-21336
08 Mar 2021 — Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pi... • http://www.openwall.com/lists/oss-security/2021/05/21/1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •