Skip to content
OpenAdvisories

Package · PyPI

plone

101 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.9
    CVE-2021-33509

    Incorrect Permission Assignment for Critical Resource in Plone

    Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.

    plone PyPI
  • Critical 9.8
    CVE-2020-7941

    Plone Unauthenticated Write Vulnerability

    A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.

    plone plone-app-contenttypes PyPI
  • Critical 9.9
    CVE-2012-5487

    Plone Sandbox Bypass

    The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importin…

    plone PyPI
  • Critical 9.8
    CVE-2012-5488

    Plone Code Injection vulnerability

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

    plone PyPI
  • Critical 9.9
    CVE-2012-5493

    Plone Sandbox Bypass

    gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.

    plone PyPI
  • Critical 9.8
    CVE-2012-5495

    Plone python code injection

    python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."

    plone PyPI
  • Critical 9.1
    CVE-2011-0720

    Plone Privilege Escalation Vulnerability

    Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.

    plone PyPI
  • Critical 9.8
    CVE-2007-5741

    Plone Arbitrary Code Execution via Unsafe Handling of Pickles

    Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.

    plone PyPI
  • Critical 9.1
    CVE-2006-4247

    Plone allows anonymous users to reset any users password through the web via Password Reset Tool

    Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."

    plone PyPI