CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2015-7316
https://notcve.org/view.php?id=CVE-2015-7316
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Plone desde la versión 3.3.0 hasta la versión 3.3.6, desde la 4.0.0 hasta la 4.0.10, desde la 4.1.0 hasta la 4.1.6, desde la 4.2.0 hasta la 4.2.7, en las versiones 4.3.x anteriores a la 4.3.7 y 5.0rc1. • http://www.openwall.com/lists/oss-security/2015/09/22/14 https://bugzilla.redhat.com/show_bug.cgi?id=1264788 https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087 https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2015-7318
https://notcve.org/view.php?id=CVE-2015-7318
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. Plone desde la versión 3.3.0 hasta la versión 3.3.6 permite que los atacantes remotos inyecten cabeceras en respuestas HTTP. • http://www.openwall.com/lists/oss-security/2015/09/22/16 https://bugzilla.redhat.com/show_bug.cgi?id=1264796 https://plone.org/security/hotfix/20150910 https://plone.org/security/hotfix/20150910/header-injection • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 51EXPL: 0CVE-2016-4042
https://notcve.org/view.php?id=CVE-2016-4042
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. Plone 3.3 hasta la versión 5.1a1 permite a atacantes remotos obtener información sobre la ID de contenido sensible a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/04/20/2 https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 57EXPL: 0CVE-2016-7147 – Plone 5.0.5 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2016-7147
Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140. Vulnerabilidad de XSS en el componente manage_findResult en la funcionalidad de búsqueda de Zope ZMI en Plone en versiones anteriores a 4.3.12 y 5.x en versiones anteriores a 5.0.7 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores que implican comillas dobles. Como se demuestra por el parámetro obj_ids: tokens. NOTA: esta vulnerabilidad existe debido a una corrección incompleta para CVE-2016-7140. • http://www.securityfocus.com/bid/96117 https://plone.org/security/hotfix/20170117 https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2 https://www.curesec.com/blog/article/blog/Plone-XSS-186.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 56EXPL: 1CVE-2016-7138 – Plone CMS 4.3.11 / 5.0.6 XSS / Traversal / Open Redirection
https://notcve.org/view.php?id=CVE-2016-7138
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en la infraestructura de comprobación de URL en Plone CMS 5.x hasta la versión 5.0.6, 4.x hasta la versión 4.3.11 y 3.3.x hasta la versión 3.3.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. Plone CMS versions 4.3.11 and below and versions 5.0.6 and below suffer from cross site scripting, open redirection, and path traversal vulnerabilities. • http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html http://seclists.org/fulldisclosure/2016/Oct/80 http://www.openwall.com/lists/oss-security/2016/09/05/4 http://www.openwall.com/lists/oss-security/2016/09/05/5 http://www.securityfocus.com/archive/1/539572/100/0/threaded http://www.securityfocus.com/bid/92752 https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •