[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[CVE-REQUEST] Plone XSS and permission errors
As a member of the Plone security response team I hereby notify you that we have been made aware of three distinct security holes in Plone and are requesting CVE identifiers.
1. Reflected XSS attack
A crafted URL can display arbitrary HTML output
2. Persistent XSS attack
3. Unauthorised data changes
One change form for data allows preferences to be changed. No deletion of content of loss of confidentiality is possible.
Thanks very much,