CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2015-7316
https://notcve.org/view.php?id=CVE-2015-7316
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Plone desde la versión 3.3.0 hasta la versión 3.3.6, desde la 4.0.0 hasta la 4.0.10, desde la 4.1.0 hasta la 4.1.6, desde la 4.2.0 hasta la 4.2.7, en las versiones 4.3.x anteriores a la 4.3.7 y 5.0rc1. • http://www.openwall.com/lists/oss-security/2015/09/22/14 https://bugzilla.redhat.com/show_bug.cgi?id=1264788 https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087 https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 49EXPL: 0CVE-2017-5524
https://notcve.org/view.php?id=CVE-2017-5524
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method. Plone 4.x en veriones hasta 4.3.11 y 5.x en versiones hasta 5.0.6 permiten atacantes remotos evitar un mecanismo de protección sandbox y obtener información sensible aprovechando el método de formato de cadenas Python. • http://www.openwall.com/lists/oss-security/2017/01/18/6 http://www.securityfocus.com/bid/95679 https://plone.org/security/hotfix/20170117/sandbox-escape • CWE-134: Use of Externally-Controlled Format String •
CVSS: 5.3EPSS: 0%CPEs: 51EXPL: 0CVE-2016-4042
https://notcve.org/view.php?id=CVE-2016-4042
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. Plone 3.3 hasta la versión 5.1a1 permite a atacantes remotos obtener información sobre la ID de contenido sensible a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/04/20/2 https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 9EXPL: 0CVE-2016-4043
https://notcve.org/view.php?id=CVE-2016-4043
Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates. Chameleon (five.pt) en Plone 5.0rc1 hasta la versión 5.1a1 permite a usuarios remotos autenticados eludir Restricted Python aprovechando permisos para crear y editar plantillas. • http://www.openwall.com/lists/oss-security/2016/04/20/3 https://plone.org/security/hotfix/20160419/bypass-restricted-python • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 44EXPL: 0CVE-2016-4041
https://notcve.org/view.php?id=CVE-2016-4041
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors. Plone 4.0 hasta la versión 5.1a1 no tiene declaraciones de seguridad para solicitudes de WebDAV relacionadas con contenido de Dexterity, lo que permite a atacantes remotos obtener acceso webdav a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/04/20/1 https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav • CWE-264: Permissions, Privileges, and Access Controls •