Versions
Plone PloneThe HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allo…
pip/PloneCross-Frame Scripting (XFS) on Plone CMS
Plone Namedfileplone.namedfile vulnerable to Stored Cross Site Scripting with SVG images
Plone PloneCross-site Scripting and Open Redirect in Products.ATContentTypes
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PlonePlone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arg…
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PloneRemote Code Execution via traversal in TAL expressions
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PloneExposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PloneThe official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank p…
Plone PloneAn open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an …
pip/plone.restapiplone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate t…
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
pip/PloneMissing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak pa…
pip/plone.app.contenttypesA privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PU…
Plone PloneBy linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his…
Plone PloneAccessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc…
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PloneWhen you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a '…
Plone PlonePlone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection…
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PloneMultiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x…
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PlonePlone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV req…
Plone PloneChameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restri…
Plone PloneKupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows …
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Plone PlonePlone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 thr…
Plone PloneZope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo…
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.