Plone

Plone

103 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5

CVE-2012-6661

Exploit
  • EPSS 0.4%
  • Published 03.11.2014 22:55:05
  • Last modified 12.04.2025 10:46:40

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT fr...

6.5

CVE-2012-5489

  • EPSS 0.58%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified...

4.3

CVE-2012-5490

  • EPSS 0.29%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3

CVE-2012-5491

  • EPSS 0.32%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.

5

CVE-2012-5492

  • EPSS 0.32%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

8.5

CVE-2012-5493

  • EPSS 0.49%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.

4.3

CVE-2012-5494

  • EPSS 0.29%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."

5

CVE-2012-5495

  • EPSS 0.64%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."

5

CVE-2012-5496

  • EPSS 0.6%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.

5

CVE-2012-5497

  • EPSS 0.44%
  • Published 30.09.2014 14:55:06
  • Last modified 12.04.2025 10:46:40

membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.