AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

A HTTP header injection flaw was found in the way Plone, a user friendly and powerful content management system, performed sanitization of HTTP headers provided within certain URL requests. A remote attacker could provide a specially-crafted URL that, when processed would lead the injected HTTP headers to be returned as part of Plone system HTTP response (possibly leading to HTTP response splitting, cross-site scripting [XSS] flaws, session fixation or unauthorized HTTP redirect attacks - to mention some of the possible negative consequences).

References: [1] http://plone.org/products/plone/security/advisories/20121106/02 [2] http://plone.org/products/plone/security/advisories/20121106/

Relevant upstream HotFixes: [3] http://plone.org/products/plone-hotfix/releases/20121106

From the OSS post: [4] http://www.openwall.com/lists/oss-security/2012/11/07/4

the setHeader.py change from upstream HotFix is relevant to this issue.

The App.Undo.UndoSupport.getrequestvarorattr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements.