CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7938
https://notcve.org/view.php?id=CVE-2020-7938
plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. plone.restapi en Plone versiones 5.2.0 hasta 5.2.1, permite a usuarios con un determinado nivel de privilegio escalar sus privilegios hasta el nivel más alto. • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installed https://www.openwall.com/lists/oss-security/2020/01/22/1 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7939
https://notcve.org/view.php?id=CVE-2020-7939
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) Una inyección SQL en DTML o en objetos de conexión en Plone versiones 4.0 hasta 5.2.1, permite a usuarios llevar a cabo consultas SQL no deseadas. (Esto es un problema en Zope). • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects https://www.openwall.com/lists/oss-security/2020/01/22/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7940
https://notcve.org/view.php?id=CVE-2020-7940
Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. Una falta de comprobaciones de la fortaleza de la contraseña en algunos formularios en Plone versiones 4.3 hasta 5.2.0, permite a usuarios establecer contraseñas débiles, conllevando a facilitar el descifrado. • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked https://www.openwall.com/lists/oss-security/2020/01/22/1 • CWE-521: Weak Password Requirements •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7941
https://notcve.org/view.php?id=CVE-2020-7941
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. Un problema de escalada de privilegios en plone.app.contenttypes en Plone versiones 4.3 hasta 5.2.1, permite a usuarios COLOCAR (sobrescribir) parte del contenido sin necesario un permiso de escritura. • http://www.openwall.com/lists/oss-security/2020/01/24/1 https://plone.org/security/hotfix/20200121 https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content https://www.openwall.com/lists/oss-security/2020/01/22/1 •
CVSS: 6.1EPSS: 0%CPEs: 67EXPL: 0CVE-2017-1000484
https://notcve.org/view.php?id=CVE-2017-1000484
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.) Al enlazar a una URL específica en Plone 2.5-5.1rc1 con un parámetro, un atacante podría enviarte a su propia página web. • https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •