CVSS: 9.8EPSS: 3%CPEs: 8EXPL: 0CVE-2007-5741
https://notcve.org/view.php?id=CVE-2007-5741
07 Nov 2007 — Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes. Plone 2.5 hasta 2.5.4 y 3.0 hasta 3.0.2 permite a atacantes remotos ejecutar código Python de su elección mediante información de red que contiene objetos "serializados" (pickled) para los módulos (1) statusmessages o (2) linkintegrity, los cuales son "deserializados"... • http://osvdb.org/42071 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4249
https://notcve.org/view.php?id=CVE-2006-4249
07 Dec 2006 — Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group." Vulnerabilidad no especificada en PlonePAS en Plone 2.5 y 2.5.1, cuando está habilitado el registro de miembros anónimos, permite a un atacante "hacerse pasar por un grupo". • http://plone.org/about/security/advisories/cve-2006-4249 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2006-4247
https://notcve.org/view.php?id=CVE-2006-4247
29 Sep 2006 — Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration." Vulnerabilidad no especificada en el Password Reset Tool anterior a 0.4.1 sobre Plone 2.5 y 2.5.1 Release Candidate, permite a un atacante remoto reiniciar las contraseñas de otros usuarios, relacionado con "una declaración erronea de seguridad". • http://plone.org/about/security/advisories/cve-2006-4247 •
CVSS: 7.5EPSS: 11%CPEs: 3EXPL: 1CVE-2006-1711 – Plone 2.x - MembershipTool Access Control Bypass
https://notcve.org/view.php?id=CVE-2006-1711
11 Apr 2006 — Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits. • https://www.exploit-db.com/exploits/27630 •