CVSS: 6.5EPSS: 0%CPEs: 68EXPL: 0CVE-2017-1000483
https://notcve.org/view.php?id=CVE-2017-1000483
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5. Acceso a contenido privado mediante str.format plantillas y scripts a través de la web en Plone 2.5-5.1rc1. Esto mejora un hotfix anterior. • https://plone.org/security/hotfix/20171128/sandbox-escape •
CVSS: 6.1EPSS: 0%CPEs: 67EXPL: 0CVE-2017-1000481
https://notcve.org/view.php?id=CVE-2017-1000481
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. • https://plone.org/security/hotfix/20171128/open-redirection-on-login-form • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.8EPSS: 0%CPEs: 34EXPL: 0CVE-2015-7317
https://notcve.org/view.php?id=CVE-2015-7317
Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings. Kupu desde la versión 3.3.0 hasta la versión 3.3.6, desde la 4.0.0 hasta la 4.0.10, desde la 4.1.0 hasta la versión 4.1.6 y desde la 4.2.0 hasta la versión 4.2.7 permite que los usuarios autenticados remotos editen la configuración de Kupu. • http://www.openwall.com/lists/oss-security/2015/09/22/15 https://bugzilla.redhat.com/show_bug.cgi?id=1264799 https://plone.org/security/hotfix/20150910 https://plone.org/security/hotfix/20150910/privilege-escalation-in-kupu • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2015-7316
https://notcve.org/view.php?id=CVE-2015-7316
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Plone desde la versión 3.3.0 hasta la versión 3.3.6, desde la 4.0.0 hasta la 4.0.10, desde la 4.1.0 hasta la 4.1.6, desde la 4.2.0 hasta la 4.2.7, en las versiones 4.3.x anteriores a la 4.3.7 y 5.0rc1. • http://www.openwall.com/lists/oss-security/2015/09/22/14 https://bugzilla.redhat.com/show_bug.cgi?id=1264788 https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087 https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2015-7318
https://notcve.org/view.php?id=CVE-2015-7318
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. Plone desde la versión 3.3.0 hasta la versión 3.3.6 permite que los atacantes remotos inyecten cabeceras en respuestas HTTP. • http://www.openwall.com/lists/oss-security/2015/09/22/16 https://bugzilla.redhat.com/show_bug.cgi?id=1264796 https://plone.org/security/hotfix/20150910 https://plone.org/security/hotfix/20150910/header-injection • CWE-20: Improper Input Validation •