CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2008-1394
https://notcve.org/view.php?id=CVE-2008-1394
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network. Plone CMS versiones anteriores a 3 pone en formato codificado base64 el nombre de usuario y la contraseña de todos los usuarios en la cookie __ac, facilitando a atacantes remotos obtener acceso mediante la escucha del tráfico de red. • http://plone.org/about/security/overview/security-overview-of-plone http://securityreason.com/securityalert/3754 http://www.procheckup.com/Hacking_Plone_CMS.pdf http://www.securityfocus.com/archive/1/489544/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/41425 • CWE-255: Credentials Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2008-0164
https://notcve.org/view.php?id=CVE-2008-0164
Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Plone CMS 3.0.5 y 3.0.6 permite a atacantes remotos (1) añadir cuentas de su elección desde la página join_form y (2) cambiar los privilegios de grupos de su elección desde la página prefs_groups_overview. • http://plone.org/about/security/advisories/cve-2008-0164 http://secunia.com/advisories/29361 http://securityreason.com/securityalert/3754 http://www.procheckup.com/Hacking_Plone_CMS.pdf http://www.securityfocus.com/archive/1/489544/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/41263 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 2%CPEs: 8EXPL: 0CVE-2007-5741
https://notcve.org/view.php?id=CVE-2007-5741
Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes. Plone 2.5 hasta 2.5.4 y 3.0 hasta 3.0.2 permite a atacantes remotos ejecutar código Python de su elección mediante información de red que contiene objetos "serializados" (pickled) para los módulos (1) statusmessages o (2) linkintegrity, los cuales son "deserializados" (unpickled) y ejecutados. • http://osvdb.org/42071 http://osvdb.org/42072 http://plone.org/about/security/advisories/cve-2007-5741 http://secunia.com/advisories/27530 http://secunia.com/advisories/27559 http://www.debian.org/security/2007/dsa-1405 http://www.securityfocus.com/archive/1/483343/100/0/threaded http://www.securityfocus.com/bid/26354 http://www.vupen.com/english/advisories/2007/3754 https://exchange.xforce.ibmcloud.com/vulnerabilities/38288 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4249
https://notcve.org/view.php?id=CVE-2006-4249
Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group." Vulnerabilidad no especificada en PlonePAS en Plone 2.5 y 2.5.1, cuando está habilitado el registro de miembros anónimos, permite a un atacante "hacerse pasar por un grupo". • http://plone.org/about/security/advisories/cve-2006-4249 http://secunia.com/advisories/23240 http://www.securityfocus.com/bid/21460 http://www.vupen.com/english/advisories/2006/4878 https://exchange.xforce.ibmcloud.com/vulnerabilities/30762 •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4247
https://notcve.org/view.php?id=CVE-2006-4247
Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration." Vulnerabilidad no especificada en el Password Reset Tool anterior a 0.4.1 sobre Plone 2.5 y 2.5.1 Release Candidate, permite a un atacante remoto reiniciar las contraseñas de otros usuarios, relacionado con "una declaración erronea de seguridad". • http://plone.org/about/security/advisories/cve-2006-4247 •