CVSS: 9.3EPSS: 96%CPEs: 60EXPL: 2CVE-2011-3587 – Plone and Zope XMLTools Remote Command Execution
https://notcve.org/view.php?id=CVE-2011-3587
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules. Vulnerabilidad no especificada en Zope v2.12.x y v2.13.x, tal como se usa en Plone v4.0.x hasta v4.0.9., v4.1, y v4.2 hasta v4.2a2, permite a atacantes remotos ejecutar comandos de su elección a través de vectores relacionados con el p_ class en OFS/misc_.py y el uso de módulos Python. • https://www.exploit-db.com/exploits/18262 http://plone.org/products/plone-hotfix/releases/20110928 http://plone.org/products/plone-hotfix/releases/20110928/PloneHotfix20110928-1.0.zip http://plone.org/products/plone/security/advisories/20110928 http://pypi.python.org/pypi/Products.PloneHotfix20110928/1.0 http://secunia.com/advisories/46221 http://secunia.com/advisories/46323 http://zope2.zope.org/news/security-vulnerability-announcement-cve-2011-3587 https://bugzilla.redhat.com/show_bug.cgi? •
CVSS: 7.5EPSS: 0%CPEs: 78EXPL: 0CVE-2011-2528
https://notcve.org/view.php?id=CVE-2011-2528
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720. Vulnerabilidad no especificada en (1) Zope v2.12.x antes de v2.12.19 y v2.13.x antes de v2.13.8, como la utilizada en Plone v4.x y otros productos, y (2) PloneHotfix20110720 para Plone v3.x permite a los atacantes obtener privilegios a través de vectores no especificados, en relación con una "vulnerabilidad muy grave". NOTA: esta vulnerabilidad existe debido a una solución incorrecta para CVE-2.011 hasta 0720. • http://plone.org/products/plone-hotfix/releases/20110622 http://plone.org/products/plone/security/advisories/20110622 http://secunia.com/advisories/45056 http://secunia.com/advisories/45111 http://www.openwall.com/lists/oss-security/2011/07/04/6 http://www.openwall.com/lists/oss-security/2011/07/12/9 https://bugzilla.redhat.com/show_bug.cgi?id=718824 https://mail.zope.org/pipermail/zope-announce/2011-June/002260.html •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2010-1104 – zope: XSS on error page
https://notcve.org/view.php?id=CVE-2010-1104
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en Zope v2.8.x antes de v2.8.12, v2.9.x antes de v2.9.12, v2.10.x antes de v2.10.11, v2.11.x antes de v2.11.6 y v2.12.x antes de v2.12.3 permite a atacantes remotos inyectar HTML o scripts web a través de vectores relacionados con los mensajes de error. • http://secunia.com/advisories/38007 http://www.osvdb.org/61655 http://www.securityfocus.com/bid/37765 http://www.vupen.com/english/advisories/2010/0104 https://exchange.xforce.ibmcloud.com/vulnerabilities/55599 https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html https://access.redhat.com/security/cve/CVE-2010-1104 https://bugzilla.redhat.com/show_bug.cgi?id=577019 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •