CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-35959
https://notcve.org/view.php?id=CVE-2021-35959
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field. En Plone versiones 5.0 hasta 5.2.4, unos editores son vulnerables a un ataque de tipo XSS en la vista de contenido de carpetas, si un colaborador ha creado una carpeta con una etiqueta SCRIPT en el campo description • http://www.openwall.com/lists/oss-security/2021/06/30/2 https://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-33507
https://notcve.org/view.php?id=CVE-2021-33507
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. Zope Products.CMFCore. versiones anteriores a 2.5.1, y Products.PluggableAuthService versiones anteriores a 2.6.2, como es usado en Plone versiones hasta 5.2.4, y otros productos, permiten un ataque de tipo XSS Reflejado • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33508
https://notcve.org/view.php?id=CVE-2021-33508
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de un nombre completo que es manejado inapropiadamente durante el renderizado de la pestaña de propiedad de un elemento de contenido • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33509
https://notcve.org/view.php?id=CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos diseñar E/S de discos por medio de argumentos de palabras clave diseñados a la transformación ReStructuredText en un script de Python • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33510
https://notcve.org/view.php?id=CVE-2021-33510
Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. Plone versiones hasta 5.2.4, permite a administradores autenticados remotos conducir ataques de tipo SSRF por medio de una URL de evento para leer una línea de un archivo • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url • CWE-918: Server-Side Request Forgery (SSRF) •