CVSS: 5.3EPSS: 1%CPEs: 72EXPL: 0CVE-2012-5498 – (Plone): Partial denial of service through Collections functionality
https://notcve.org/view.php?id=CVE-2012-5498
16 Sep 2014 — queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection. queryCatalog.py en Plone anterior a 4.2.3 y 4.3 anterior a beta 1 permite a atacantes remotos evadir el chacheo y causar una denegación de servicio a través de una solicitud manipulada en una colección. It was discovered that Plone, included as a part of luci, did not properly handle the processing of requests for certain collections. A re... • http://rhn.redhat.com/errata/RHSA-2014-1194.html • CWE-264: Permissions, Privileges, and Access Controls CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 72EXPL: 0CVE-2012-5499 – (Plone): Partial denial of service through internal function
https://notcve.org/view.php?id=CVE-2012-5499
16 Sep 2014 — python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns. python_scripts.py en Plone anterior a 4.2.3 y 4.3 anterior a beta 1 permite a atacantes remotos causar una denegación de servicio (consumo de memoria) a través de un valor grande, relacionado con formatColumns. It was discovered that Plone, included as a part of luci, did not properly handle the processing of very large values pa... • http://rhn.redhat.com/errata/RHSA-2014-1194.html • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2012-5500 – (Plone): Anonymous users can batch change titles of content items
https://notcve.org/view.php?id=CVE-2012-5500
16 Sep 2014 — The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request. La secuencias de comandos de cambio de id de batch (renameObjectsByPaths.py) en Plone anterior a 4.2.3 y 4.3 anterior a beta 1 permite a atacantes remotos cambiar los títulos de elementos del contenido mediante el aprovechamiento de un token CSRF válido en una solicitud manipulada. It was discover... • http://rhn.redhat.com/errata/RHSA-2014-1194.html • CWE-284: Improper Access Control CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 33EXPL: 0CVE-2013-7060
https://notcve.org/view.php?id=CVE-2013-7060
02 May 2014 — Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope. Products/CMFPlone/FactoryTool.py en Plone 3.3 hasta 4.3.2 permite a atacantes remotos obtener la ruta de instalación a través de vectores relacionados con un objeto de archivo para documentación no especificada que es inicializada en el ámbito de clase. • http://www.openwall.com/lists/oss-security/2013/12/10/15 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 33EXPL: 0CVE-2013-7061
https://notcve.org/view.php?id=CVE-2013-7061
02 May 2014 — Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API. Products/CMFPlone/CatalogTool.py en Plone 3.3 hasta 4.3.2 permite a administradores remotos evadir restricciones y obtener información sensible a través de una API de búsqueda no especificada. • http://www.openwall.com/lists/oss-security/2013/12/10/15 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4188
https://notcve.org/view.php?id=CVE-2013-4188
11 Mar 2014 — traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources." traverser.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permite a atacantes remotos con privilegios de administrador causar una denegación de servicio (bucle infinito y consumo de recursos) a través de ... • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-399: Resource Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4189
https://notcve.org/view.php?id=CVE-2013-4189
11 Mar 2014 — Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors. Múltiples vulnerabilidades no especificadas en (1) dataitems.py, (2) get.py y (3) traverseName.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permiten a usuarios remotos autenticados con acceso administ... • http://plone.org/products/plone-hotfix/releases/20130618 •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4190
https://notcve.org/view.php?id=CVE-2013-4190
11 Mar 2014 — Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en (1) spamProtect.py, (2) pts.py y (3) request.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permiten a atacantes remotos inyectar script Web o HTML arbitrarios a través de vectores no especific... • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4191
https://notcve.org/view.php?id=CVE-2013-4191
11 Mar 2014 — zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive. zip.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 no fuerza debidamente restricciones de acceso cuando involucra contenido en un archivo zip, lo que permite a atacantes remotos obtener información sensible mediante la lectura de un ar... • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2013-4192
https://notcve.org/view.php?id=CVE-2013-4192
11 Mar 2014 — sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors. sendto.py en Plone 2.1 hasta 4.1, 4.2.x hasta 4.2.5 y 4.3.x hasta 4.3.1 permite a usuarios remotos autenticados falsificar emails a través de vectores no especificados. • http://plone.org/products/plone-hotfix/releases/20130618 • CWE-20: Improper Input Validation •