PyPI Package Vulnerabilities
Vulnerabilities associated with Products.CMFPlone.
Packages
Clear package- tensorflow433 vulnerabilities
- tensorflow-gpu427 vulnerabilities
- tensorflow-cpu423 vulnerabilities
- Django147 vulnerabilities
- open-webui133 vulnerabilities
- apache-airflow129 vulnerabilities
- Plone96 vulnerabilities
- mlflow79 vulnerabilities
- apache-superset67 vulnerabilities
- salt67 vulnerabilities
- ansible66 vulnerabilities
- pillow61 vulnerabilities
- picklescan59 vulnerabilities
- vllm59 vulnerabilities
- gradio49 vulnerabilities
- nova49 vulnerabilities
- aiohttp48 vulnerabilities
- pyload-ng48 vulnerabilities
- matrix-synapse45 vulnerabilities
- vyper44 vulnerabilities
- rdiffweb43 vulnerabilities
- praisonai40 vulnerabilities
- keystone39 vulnerabilities
- pypdf39 vulnerabilities
- PraisonAI37 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Cross-site Scripting and Open Redirect in Products.CMFPlone### Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings. ### Patches No patch is available for the Products.CMFPlone 4 series. Versions 5.0 and higher are… CWE-79Jan 28, 2022 | CVSS-v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Products.CMFPlone Open Redirect VulnerabilityWhen you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of th… CWE-601Jan 3, 2018 | CVSS-v4.0 | EPSS0.685% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Products.CMFPlone XSS in profile home_page propertyA member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page. CWE-79Jan 3, 2018 | CVSS-v4.0 | EPSS0.56% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Plone unauthorized member addition vulnerabilityPlone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator. CWE-284Sep 25, 2017 | CVSS-v4.0 | EPSS2.02% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Plone Privilege escalation through exposed underlying APIProducts/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API. | CVSS-v4.0 | EPSS1.32% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Plone Filesystem path information leakProducts/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope. CWE-200May 2, 2014 | CVSS-v4.0 | EPSS2.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Cross-site scripting in Products.CMFPlone and Products.PasswordResetToolCross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL. CWE-79Jun 6, 2011 | CVSS-v4.0 | EPSS2.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |