CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33513
https://notcve.org/view.php?id=CVE-2021-33513
Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. Plone versiones hasta 5.2.4, permite un ataque de tipo XSS por medio de los métodos inline_diff en Products.CMFDiffTool • http://www.openwall.com/lists/oss-security/2021/05/22/1 https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 1CVE-2021-32633 – Remote Code Execution via traversal in TAL expressions
https://notcve.org/view.php?id=CVE-2021-32633
Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. • http://www.openwall.com/lists/oss-security/2021/05/21/1 http://www.openwall.com/lists/oss-security/2021/05/22/1 https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633 https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91 https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21336 – Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
https://notcve.org/view.php?id=CVE-2021-21336
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`. Products.PluggableAuthService es un framework de autenticación y autorización de Zope conectable. • http://www.openwall.com/lists/oss-security/2021/05/21/1 http://www.openwall.com/lists/oss-security/2021/05/22/1 https://github.com/zopefoundation/Products.PluggableAuthService/commit/2dad81128250cb2e5d950cddc9d3c0314a80b4bb https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7p https://pypi.org/project/Products.PluggableAuthService • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •