CVSS: 3.5EPSS: 0%CPEs: 44EXPL: 0CVE-2011-1949
https://notcve.org/view.php?id=CVE-2011-1949
Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Filtro safe_html en Products.PortalTransforms de Plone v2.1 hasta v4.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados, vulnerabilidad diferente de CVE-2010-2422. • http://osvdb.org/72728 http://plone.org/products/plone/security/advisories/CVE-2011-1949 http://secunia.com/advisories/44775 http://secunia.com/advisories/44776 http://securityreason.com/securityalert/8269 http://www.securityfocus.com/archive/1/518155/100/0/threaded http://www.securityfocus.com/bid/48005 https://exchange.xforce.ibmcloud.com/vulnerabilities/67694 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 34EXPL: 0CVE-2011-0720 – plone: unauthorized remote administrative access
https://notcve.org/view.php?id=CVE-2011-0720
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors. Una vulnerabilidad no especificada en Plone versión 2.5 hasta 4.0, como se utiliza en Conga, luci, y posiblemente otros productos, permite a los atacantes remotos obtener acceso administrativo, leer o crear contenido arbitrario, y cambiar el aspecto del sitio por medio de vectores desconocidos. • http://osvdb.org/70753 http://plone.org/products/plone/security/advisories/cve-2011-0720 http://secunia.com/advisories/43146 http://secunia.com/advisories/43914 http://www.redhat.com/support/errata/RHSA-2011-0393.html http://www.redhat.com/support/errata/RHSA-2011-0394.html http://www.securityfocus.com/bid/46102 http://www.securitytracker.com/id?1025258 http://www.vupen.com/english/advisories/2011/0796 https://exchange.xforce.ibmcloud.com/vulnerabilities/65099 https://acce • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 36EXPL: 0CVE-2010-2422
https://notcve.org/view.php?id=CVE-2010-2422
Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en PortalTransforms en Plone v2.1 hasta v3.3.4 anterior hotfix 20100612 permite a atacantes remotos inyectar código web o HTML de su elección a través de safe_html transform. • http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_html http://secunia.com/advisories/40270 http://www.securityfocus.com/bid/40999 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 1CVE-2008-4571
https://notcve.org/view.php?id=CVE-2008-4571
Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo LiveSearch de Plone antes de 3.0.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante el campo Description para resultados de búsqueda, como se demostró utilizando el evento Javascript onerror en una etiqueta IMG. • http://dev.plone.org/plone/ticket/7439 http://osvdb.org/40660 http://plone.org/products/plone/releases/3.0.4 http://secunia.com/advisories/28293 http://www.securityfocus.com/bid/27098 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 8EXPL: 0CVE-2007-5741
https://notcve.org/view.php?id=CVE-2007-5741
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes. Plone 2.5 hasta 2.5.4 y 3.0 hasta 3.0.2 permite a atacantes remotos ejecutar código Python de su elección mediante información de red que contiene objetos "serializados" (pickled) para los módulos (1) statusmessages o (2) linkintegrity, los cuales son "deserializados" (unpickled) y ejecutados. • http://osvdb.org/42071 http://osvdb.org/42072 http://plone.org/about/security/advisories/cve-2007-5741 http://secunia.com/advisories/27530 http://secunia.com/advisories/27559 http://www.debian.org/security/2007/dsa-1405 http://www.securityfocus.com/archive/1/483343/100/0/threaded http://www.securityfocus.com/bid/26354 http://www.vupen.com/english/advisories/2007/3754 https://exchange.xforce.ibmcloud.com/vulnerabilities/38288 • CWE-94: Improper Control of Generation of Code ('Code Injection') •