CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7936
https://notcve.org/view.php?id=CVE-2020-7936
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site. Un redireccionamiento abierto en el formulario de inicio de sesión (y posiblemente en otros lugares) en Plone versiones 4.0 hasta 5.2.1, permite a un atacante diseñar un enlace hacia un Sitio de Plone que, cuando es seguido, y posiblemente después del inicio de sesión, redireccionará hacia el sitio de un atacante. • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places https://www.openwall.com/lists/oss-security/2020/01/22/1 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7937
https://notcve.org/view.php?id=CVE-2020-7937
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site. Un problema de tipo XSS en el campo title en Plone versiones 5.0 hasta 5.2.1, permite a usuarios con un determinado nivel de privilegio insertar JavaScript que será ejecutado cuando otros usuarios accedan al sitio. • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher https://www.openwall.com/lists/oss-security/2020/01/22/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7938
https://notcve.org/view.php?id=CVE-2020-7938
plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. plone.restapi en Plone versiones 5.2.0 hasta 5.2.1, permite a usuarios con un determinado nivel de privilegio escalar sus privilegios hasta el nivel más alto. • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installed https://www.openwall.com/lists/oss-security/2020/01/22/1 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7939
https://notcve.org/view.php?id=CVE-2020-7939
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) Una inyección SQL en DTML o en objetos de conexión en Plone versiones 4.0 hasta 5.2.1, permite a usuarios llevar a cabo consultas SQL no deseadas. (Esto es un problema en Zope). • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects https://www.openwall.com/lists/oss-security/2020/01/22/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7940
https://notcve.org/view.php?id=CVE-2020-7940
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. Una falta de comprobaciones de la fortaleza de la contraseña en algunos formularios en Plone versiones 4.3 hasta 5.2.0, permite a usuarios establecer contraseñas débiles, conllevando a facilitar el descifrado. • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked https://www.openwall.com/lists/oss-security/2020/01/22/1 • CWE-521: Weak Password Requirements •