Skip to content

Plone vulnerabilities

Products

Newest

plonePlone Authenticated Denial of Service vulnerabilityCVE-2013-4188Fix available4.3 MediumMarch 11, 2014
plonePlone Open Redirection vulnerability via next parameterCVE-2013-4200Public exploitFix available5.8 MediumJanuary 21, 2014
plonePlone Denial of Service vulnerabilityCVE-2011-4462Fix available5.0 MediumDecember 30, 2011
plone cmfeditions, plone +1 morePlone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishableCVE-2011-4030Fix available9.3 HighOctober 10, 2011
plone, zope +1 moreZope Command Execution VulnerabilityCVE-2011-3587Public exploitFix availableEPSS 78.1%9.3 HighOctober 10, 2011
plonePlone XSS VulnerabilityCVE-2011-1340Fix available4.3 MediumAugust 5, 2011
plone, zope, plone hotfix 20110720 +2 moreHigh severity vulnerability that affects Plone and Zope2CVE-2011-2528Fix available7.5 HighJuly 19, 2011
plonePlone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accountsCVE-2011-1950Fix available5.5 MediumJune 6, 2011
plonePlone Cross-site Scripting vulnerabilityCVE-2011-1949Fix available3.5 LowJune 6, 2011
ploneCross-site scripting in Products.CMFPlone and Products.PasswordResetToolCVE-2011-1948Fix available4.3 MediumJune 6, 2011
plone, redhat conga, luci +2 morePlone Privilege Escalation VulnerabilityCVE-2011-0720Fix available7.5 HighFebruary 3, 2011
plonePlone Cross-site Scripting vulnerability in PortalTransformsCVE-2010-2422Fix available4.3 MediumJune 23, 2010
plone plonepasModerate severity vulnerability that affects Products.PlonePASCVE-2009-0662Fix available6.0 MediumApril 23, 2009
plonePlone Cross-site Scripting vulnerability in the LiveSearch moduleCVE-2008-4571Fix available4.3 MediumOctober 15, 2008
plone cmsPlone credentials stored in session cookieCVE-2008-13964.3 MediumMarch 20, 2008
plone cmsPlone CMS does not record users' authentication states, and implements the logout feature solely...CVE-2008-13957.5 HighMarch 20, 2008
plone cmsPlone CMS Improper Session ManagementCVE-2008-1394Fix available7.5 HighMarch 20, 2008
plone cmsPlone Improper Session ManagementCVE-2008-1393Fix available10.0 HighMarch 20, 2008
plone cmsPlone Cross-site request forgery (CSRF)CVE-2008-0164Fix available4.3 MediumMarch 20, 2008
plonePlone Arbitrary Code Execution via Unsafe Handling of PicklesCVE-2007-5741Fix available7.5 HighNovember 7, 2007
plonePlone allows a user to masquerade as a groupCVE-2006-4249Fix available4.3 MediumDecember 7, 2006
plonePlone allows anonymous users to reset any users password through the web via Password Reset ToolCVE-2006-4247Fix available6.4 MediumSeptember 29, 2006
plonePlone allows remote users to modify arbitrary portraitsCVE-2006-1711Public exploitFix available5.0 MediumApril 11, 2006