plone 6.0.8: known vulnerabilities

Could not compare 2 records. The results are incomplete.

1. CVE-2024-22889

   Medium · CVSS 5.5EPSS 0.7%No fix published

   CVE-2024-22889

   Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

   plonePython

   Published March 5, 2024Updated October 31, 2024

   Source advisory 1 ↗Source advisory 2 ↗

2. CVE-2006-1711

   Not ratedEPSS 4.02%Public exploitNo fix published

   CVE-2006-1711

   Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

   plonePython

   Published April 11, 2006Updated August 7, 2024

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗