Skip to content
OpenAdvisories

Archive

30 September 2014

Vulnerabilities first published on this day (UTC), newest first.

← August 2014 2014 / September /30 October 2014 →
  1. 13
  2. 212
  3. 310
  4. 423
  5. 515
  6. 6 
  7. 7 
  8. 85
  9. 9326
  10. 1079
  11. 1145
  12. 1222
  13. 13 
  14. 14 
  15. 1527
  16. 16 
  17. 1732
  18. 1893
  19. 1935
  20. 2041
  21. 21 
  22. 2262
  23. 2359
  24. 2412
  25. 2527
  26. 2623
  27. 2717
  28. 2842
  29. 2953
  30. 3083
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2012-5490

    Plone Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    plone PyPI
  • Medium 5.3
    CVE-2012-5492

    Plone Metadata Disclosure

    uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.

    plone PyPI
  • Medium 6.1
    CVE-2012-5502

    Plone Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors.

    plone PyPI
  • Medium 5.3
    CVE-2012-5491

    Plone Information Disclosure

    z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.

    plone PyPI
  • Medium 6.5
    CVE-2012-5489

    Plone and Zope2 vulnerable to unauthorized access to restricted attributes

    The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

    plone zope2 PyPI
  • Medium 5.3
    CVE-2012-5497

    Plone User account enumeration via crafted URL

    membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.

    plone PyPI
  • Medium 6.1
    CVE-2012-5494

    Plone Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."

    plone PyPI
  • Medium 6.1
    CVE-2012-5504

    Plone Cross-site scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    plone PyPI
  • Medium —
    CVE-2014-3558

    Improper Authentication in Hibernate Validator

    ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls vi…

    libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven