CVSS: 5.3EPSS: 0%CPEs: 72EXPL: 0CVE-2012-5497 – (Plone): Anonymous users can list user account names
https://notcve.org/view.php?id=CVE-2012-5497
16 Sep 2014 — membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL. membership_tool.py en Plone anterior a 4.2.3 y 4.3 anterior a beta 1 permite a atacantes remotos enumerar los nombres de las cuentas de usuarios a través de una URL manipulada. It was discovered that Plone, included as a part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially crafted URL that, when proc... • http://rhn.redhat.com/errata/RHSA-2014-1194.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 1%CPEs: 72EXPL: 0CVE-2012-5498 – (Plone): Partial denial of service through Collections functionality
https://notcve.org/view.php?id=CVE-2012-5498
16 Sep 2014 — queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection. queryCatalog.py en Plone anterior a 4.2.3 y 4.3 anterior a beta 1 permite a atacantes remotos evadir el chacheo y causar una denegación de servicio a través de una solicitud manipulada en una colección. It was discovered that Plone, included as a part of luci, did not properly handle the processing of requests for certain collections. A re... • http://rhn.redhat.com/errata/RHSA-2014-1194.html • CWE-264: Permissions, Privileges, and Access Controls CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 1%CPEs: 72EXPL: 0CVE-2012-5499 – (Plone): Partial denial of service through internal function
https://notcve.org/view.php?id=CVE-2012-5499
16 Sep 2014 — python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns. python_scripts.py en Plone anterior a 4.2.3 y 4.3 anterior a beta 1 permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un valor grande, relacionado con formatColumns. It was discovered that Plone, included as a part of luci, did not properly handle the processing of very large values pa... • http://rhn.redhat.com/errata/RHSA-2014-1194.html • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2012-5500 – (Plone): Anonymous users can batch change titles of content items
https://notcve.org/view.php?id=CVE-2012-5500
16 Sep 2014 — The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request. La secuencias de comandos de cambio de id de batch (renameObjectsByPaths.py) en Plone anterior a 4.2.3 y 4.3 anterior a beta 1 permite a atacantes remotos cambiar los títulos de elementos del contenido mediante el aprovechamiento de un token CSRF válido en una solicitud manipulada. It was discover... • http://rhn.redhat.com/errata/RHSA-2014-1194.html • CWE-284: Improper Access Control CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4196
https://notcve.org/view.php?id=CVE-2013-4196
11 Mar 2014 — The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request. La implementación object manager (objectmanager.py) en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 no restringe debidamente acceso a los métodos internos, lo que permite a atacantes remotos obtener información sensible a través de un... • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.8EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4195
https://notcve.org/view.php?id=CVE-2013-4195
11 Mar 2014 — Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Múltiples vulnerabilidades de redirección abierta en (1) marmoset_patch.py, (2) publish.py y (3) principiaredirect.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permiten a atacantes remotos redi... • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4193
https://notcve.org/view.php?id=CVE-2013-4193
11 Mar 2014 — typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL. typeswidget.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 no fuerza debidamente la configuración inmutable en formularios de editar contenido no especificados, lo que permite a atacantes remotos esconder campos en los formularios a través de una U... • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 1%CPEs: 52EXPL: 0CVE-2013-4199
https://notcve.org/view.php?id=CVE-2013-4199
11 Mar 2014 — (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed). (1) cb_decode.py y (2) linkintegrity.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permiten a usuarios remotos autenticados causar una denegación de servicio (consumo de recursos) a través de un archivo zip grande, el cual es expandido ... • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4189
https://notcve.org/view.php?id=CVE-2013-4189
11 Mar 2014 — Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors. Múltiples vulnerabilidades no especificadas en (1) dataitems.py, (2) get.py y (3) traverseName.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permiten a usuarios remotos autenticados con acceso administ... • http://plone.org/products/plone-hotfix/releases/20130618 •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4194
https://notcve.org/view.php?id=CVE-2013-4194
11 Mar 2014 — The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message. El componente WYSIWYG (wysiwyg.py) en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permite a atacantes remotos obtener información sensible a través de una URL manipulada, lo que revela la ruta de instalación en un mensaje de error. • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •