CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2015-7318
https://notcve.org/view.php?id=CVE-2015-7318
Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. Plone desde la versión 3.3.0 hasta la versión 3.3.6 permite que los atacantes remotos inyecten cabeceras en respuestas HTTP. • http://www.openwall.com/lists/oss-security/2015/09/22/16 https://bugzilla.redhat.com/show_bug.cgi?id=1264796 https://plone.org/security/hotfix/20150910 https://plone.org/security/hotfix/20150910/header-injection • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 49EXPL: 0CVE-2017-5524
https://notcve.org/view.php?id=CVE-2017-5524
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method. Plone 4.x en veriones hasta 4.3.11 y 5.x en versiones hasta 5.0.6 permiten atacantes remotos evitar un mecanismo de protección sandbox y obtener información sensible aprovechando el método de formato de cadenas Python. • http://www.openwall.com/lists/oss-security/2017/01/18/6 http://www.securityfocus.com/bid/95679 https://plone.org/security/hotfix/20170117/sandbox-escape • CWE-134: Use of Externally-Controlled Format String •
CVSS: 4.9EPSS: 0%CPEs: 9EXPL: 0CVE-2016-4043
https://notcve.org/view.php?id=CVE-2016-4043
Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates. Chameleon (five.pt) en Plone 5.0rc1 hasta la versión 5.1a1 permite a usuarios remotos autenticados eludir Restricted Python aprovechando permisos para crear y editar plantillas. • http://www.openwall.com/lists/oss-security/2016/04/20/3 https://plone.org/security/hotfix/20160419/bypass-restricted-python • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 44EXPL: 0CVE-2016-4041
https://notcve.org/view.php?id=CVE-2016-4041
Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access via unspecified vectors. Plone 4.0 hasta la versión 5.1a1 no tiene declaraciones de seguridad para solicitudes de WebDAV relacionadas con contenido de Dexterity, lo que permite a atacantes remotos obtener acceso webdav a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/04/20/1 https://plone.org/security/hotfix/20160419/privilege-escalation-in-webdav • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 0%CPEs: 51EXPL: 0CVE-2016-4042
https://notcve.org/view.php?id=CVE-2016-4042
Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. Plone 3.3 hasta la versión 5.1a1 permite a atacantes remotos obtener información sobre la ID de contenido sensible a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/04/20/2 https://plone.org/security/hotfix/20160419/unauthorized-disclosure-of-site-content • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •