CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1396
https://notcve.org/view.php?id=CVE-2008-1396
Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network. Plone CMS 3.x utiliza datos no variables (un nombre de usario y un servidor secreto) cuando calcula un valor HMAC-SHA1 para la cookie de autenticación, facilitando que atacantes remotos obtengan acceso permanente a una cuenta mediante la escucha del tráfico de red. • http://securityreason.com/securityalert/3754 http://www.procheckup.com/Hacking_Plone_CMS.pdf http://www.securityfocus.com/archive/1/489544/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/41421 • CWE-255: Credentials Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1395
https://notcve.org/view.php?id=CVE-2008-1395
Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session. Plone CMS no registra el estado de autenticación de los usarios, e implementa la función de desconexión sólo en el lado del cliente, facilitando la reutilización de sesiones finalizadas por atacantes dependientes del contexto. • http://securityreason.com/securityalert/3754 http://www.procheckup.com/Hacking_Plone_CMS.pdf http://www.securityfocus.com/archive/1/489544/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/41423 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 2CVE-2008-1393
https://notcve.org/view.php?id=CVE-2008-1393
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network. Plone CMS 3.0.5, y probablemente otras versiones 3.x, coloca en formato codificado base64 el nombre de usuario y contraseña del usuario admin en la cookie __ac, facilitando a atacantes remotos la obtención de privilegios de adminitrador mediante la escucha del tráfico de red. • http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords http://plone.org/products/plone/roadmap/48? http://securityreason.com/securityalert/3754 http://www.procheckup.com/Hacking_Plone_CMS.pdf http://www.securityfocus.com/archive/1/489544/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/41427 • CWE-255: Credentials Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2008-1394
https://notcve.org/view.php?id=CVE-2008-1394
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network. Plone CMS versiones anteriores a 3 pone en formato codificado base64 el nombre de usuario y la contraseña de todos los usuarios en la cookie __ac, facilitando a atacantes remotos obtener acceso mediante la escucha del tráfico de red. • http://plone.org/about/security/overview/security-overview-of-plone http://securityreason.com/securityalert/3754 http://www.procheckup.com/Hacking_Plone_CMS.pdf http://www.securityfocus.com/archive/1/489544/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/41425 • CWE-255: Credentials Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1CVE-2008-0164
https://notcve.org/view.php?id=CVE-2008-0164
Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Plone CMS 3.0.5 y 3.0.6 permite a atacantes remotos (1) añadir cuentas de su elección desde la página join_form y (2) cambiar los privilegios de grupos de su elección desde la página prefs_groups_overview. • http://plone.org/about/security/advisories/cve-2008-0164 http://secunia.com/advisories/29361 http://securityreason.com/securityalert/3754 http://www.procheckup.com/Hacking_Plone_CMS.pdf http://www.securityfocus.com/archive/1/489544/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/41263 • CWE-352: Cross-Site Request Forgery (CSRF) •