Cpe Name:
cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*
# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2013-7061 |
264 |
|
Bypass +Info |
2014-05-02 |
2014-06-30 |
5.5 |
None |
Remote |
Low |
??? |
Partial |
Partial |
None |
Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API. |
2 |
CVE-2013-4200 |
264 |
|
Bypass |
2014-01-21 |
2018-10-09 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login. |
3 |
CVE-2013-4198 |
264 |
|
Bypass |
2014-03-11 |
2014-03-12 |
4.0 |
None |
Remote |
Low |
??? |
None |
Partial |
None |
mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality. |
4 |
CVE-2012-5498 |
264 |
|
DoS Bypass |
2014-09-30 |
2015-11-17 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection. |
5 |
CVE-2012-5493 |
94 |
|
Exec Code Bypass |
2014-09-30 |
2014-10-01 |
8.5 |
None |
Remote |
Medium |
??? |
Complete |
Complete |
Complete |
gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors. |
6 |
CVE-2012-5487 |
264 |
|
Exec Code Bypass |
2014-09-30 |
2014-10-01 |
8.5 |
None |
Remote |
Medium |
??? |
Complete |
Complete |
Complete |
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing. |
Total number of vulnerabilities :
6
Page :
1
(This Page)