Skip to content
OpenAdvisories

Archive

30 September 2014

Vulnerabilities first published on this day (UTC), newest first.

← August 2014 2014 / September /30 October 2014 →
  1. 13
  2. 212
  3. 310
  4. 423
  5. 515
  6. 6 
  7. 7 
  8. 85
  9. 9326
  10. 1079
  11. 1145
  12. 1222
  13. 13 
  14. 14 
  15. 1527
  16. 16 
  17. 1732
  18. 1893
  19. 1935
  20. 2041
  21. 21 
  22. 2262
  23. 2359
  24. 2412
  25. 2527
  26. 2623
  27. 2717
  28. 2842
  29. 2953
  30. 3083
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • High 7.2
    CVE-2012-5485

    Plone Code Injection vulnerability

    registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

    plone PyPI
  • High 7.5
    CVE-2012-5486

    HTTP header injection in Plone and Zope2

    ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

    plone zope2 PyPI
  • High 7.5
    CVE-2012-5501

    Plone Arbitrary File Read

    at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.

    plone PyPI
  • High 7.5
    CVE-2012-5505

    Plone Information Disclosure

    atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.

    plone PyPI
  • High 7.5
    CVE-2012-5496

    Plone DoS via Crafted URL

    kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.

    plone PyPI
  • High 7.5
    CVE-2012-5506

    Plone denial of service via RSS Feed Request

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permission to access.

    plone PyPI
  • High 7.5
    CVE-2012-5498

    Plone denial of service via Caching Bypass

    queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.

    plone PyPI
  • High 7.5
    CVE-2012-5499

    Plone is vulnerable to denial of service

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.

    plone PyPI
  • High 7.5
    CVE-2012-5503

    Plone allows remote attackers to read hidden folder contents

    ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.

    plone PyPI
  • High 7.5
    CVE-2012-5507

    Plone and Zope2 affected by Race Condition

    AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

    plone zope2 PyPI
  • High 8.8
    CVE-2014-6278 Exploited Public exploit EPSS 100%

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, wh…

    bash bash Debian Ubuntu
    KEV Oct 2, 2025