İçeriğe atla
Noroxi

plone kayıtları

plone üreticisine ait 116 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
1 · %0,9
Pre-auth RCE
7
Düzeltme kaydı olan
%92,2
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 17
  2. 18
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

116 kayıt
  • CVE-2011-3587
    60Bu hafta

    Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attacke

    KritikCVSS 9,3SilahlaştırılmışEPSS %78

    plone · plone10 Eki 2011

  • CVE-2008-1393
    41Planlayın

    Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin

    KritikCVSS 10,0İstismar yokEPSS %3

    plone · plone cms19 Mar 2008

  • CVE-2020-7941
    40Planlayın

    A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needi

    KritikCVSS 9,8İstismar yokEPSS %2

    plone · plone23 Oca 2020

  • CVE-2020-35190
    40Planlayın

    The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.

    KritikCVSS 9,8İstismar yokEPSS %2

    plone · plone16 Ara 2020

  • CVE-2021-33509
    40Planlayın

    Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform

    KritikCVSS 9,9İstismar yokEPSS %2

    plone · plone21 May 2021

  • CVE-2024-23054
    39İzleyin

    An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package liste

    KritikCVSS 9,8İstismar yokEPSS %1

    plone · plone docker official image5 Şub 2024

  • CVE-2011-4030
    38İzleyin

    The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from bein

    KritikCVSS 9,3İstismar yokEPSS %2

    plone · cmfeditions10 Eki 2011

  • CVE-2015-7293
    36İzleyin

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    plone · plone25 Eyl 2017

  • CVE-2021-32633
    36İzleyin

    Remote Code Execution via traversal in TAL expressions

    YüksekCVSS 8,8İstismar yokEPSS %2

    zope · zope21 May 2021

  • CVE-2012-5487
    35İzleyin

    The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certai

    YüksekCVSS 8,5İstismar yokEPSS %2

    plone · plone30 Eyl 2014

  • CVE-2012-5493
    35İzleyin

    gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox

    YüksekCVSS 8,5İstismar yokEPSS %2

    plone · plone30 Eyl 2014

  • CVE-2020-7938
    35İzleyin

    plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.

    YüksekCVSS 8,8İstismar yokEPSS %1

    plone · plone23 Oca 2020

  • CVE-2020-28735
    35İzleyin

    Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

    YüksekCVSS 8,8İstismar yokEPSS %1

    plone · plone30 Ara 2020

  • CVE-2020-28736
    35İzleyin

    Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (there

    YüksekCVSS 8,8İstismar yokEPSS %1

    plone · plone30 Ara 2020

  • CVE-2020-28734
    35İzleyin

    Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

    YüksekCVSS 8,8İstismar yokEPSS %1

    plone · plone30 Ara 2020

  • CVE-2020-7939
    35İzleyin

    SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries.

    YüksekCVSS 8,8İstismar yokEPSS %1

    plone · plone23 Oca 2020

  • CVE-2021-33926
    35İzleyin

    An issue in Plone CMS v.

    YüksekCVSS 8,8İstismar yokEPSS %1

    plone · plone17 Şub 2023

  • CVE-2011-0720
    31İzleyin

    Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain a

    YüksekCVSS 7,5İstismar yokEPSS %3

    plone · plone3 Şub 2011

  • CVE-2007-5741
    31İzleyin

    Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled o

    YüksekCVSS 7,5İstismar yokEPSS %2

    plone · plone7 Kas 2007

  • CVE-2011-2528
    31İzleyin

    Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) Plone

    YüksekCVSS 7,5İstismar yokEPSS %2

    plone · plone hotfix 2011072019 Tem 2011

  • CVE-2015-7318
    31İzleyin

    Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.

    YüksekCVSS 7,5İstismar yokEPSS %2

    plone · plone25 Eyl 2017

  • CVE-2008-1394
    30İzleyin

    Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier

    YüksekCVSS 7,5İstismar yokEPSS %1

    plone · plone cms19 Mar 2008

  • CVE-2008-1395
    30İzleyin

    Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier f

    YüksekCVSS 7,5İstismar yokEPSS %1

    plone · plone cms19 Mar 2008

  • CVE-2020-7940
    30İzleyin

    Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.

    YüksekCVSS 7,5İstismar yokEPSS %1

    plone · plone23 Oca 2020

  • CVE-2021-33511
    30İzleyin

    Plone though 5.2.4 allows SSRF via the lxml parser.

    YüksekCVSS 7,5İstismar yokEPSS %1

    plone · plone21 May 2021