CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33509
https://notcve.org/view.php?id=CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos diseñar E/S de discos por medio de argumentos de palabras clave diseñados a la transformación ReStructuredText en un script de Python • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33510
https://notcve.org/view.php?id=CVE-2021-33510
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos conducir ataques de tipo SSRF por medio de una URL de evento para leer una línea de un archivo • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33511
https://notcve.org/view.php?id=CVE-2021-33511
Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel. Plone versiones hasta 5.2.4, permite un ataque de tipo SSRF por medio del analizador lxml. Esto afecta los temas Diazo, esquemas Dexterity TTW y modeladores en plone.app.theming, plone.app.dexterity y plone.supermodel • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33512
https://notcve.org/view.php?id=CVE-2021-33512
Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS almacenado (por un Colaborador) al cargar un documento SVG o HTML • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33513
https://notcve.org/view.php?id=CVE-2021-33513
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de los métodos inline_diff en Products.CMFDiffTool • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •