https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 19:42:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-107280 EUVD-2026-107280 https://cve.radiocsirt.org/vuln/euvd-2026-107280 https://cve.radiocsirt.org/vuln/fkie_cve-2013-4200 <p>The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the &#34;next&#34; parameter to acl_users/credentials_cookie_auth/require_login.</p> <p>The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the &#34;next&#34; parameter to acl_users/credentials_cookie_auth/require_login.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2013-4200 https://cve.radiocsirt.org/vuln/ghsa-56p3-rrp4-2j82 <p><strong>Affected:</strong> PyPI: Plone</p> <p>The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the &#34;next&#34; parameter to acl_users/credentials_cookie_auth/require_login.</p> <p><strong>Affected:</strong> PyPI: Plone</p> <p>The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the &#34;next&#34; parameter to acl_users/credentials_cookie_auth/require_login.</p> https://cve.radiocsirt.org/vuln/ghsa-56p3-rrp4-2j82 https://cve.radiocsirt.org/vuln/gsd-2013-4200 gsd-2013-4200 https://cve.radiocsirt.org/vuln/gsd-2013-4200 https://cve.radiocsirt.org/vuln/pysec-2014-64 <p><strong>Affected:</strong> PyPI: plone</p> <p>The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the &#34;next&#34; parameter to acl_users/credentials_cookie_auth/require_login.</p> <p><strong>Affected:</strong> PyPI: plone</p> <p>The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the &#34;next&#34; parameter to acl_users/credentials_cookie_auth/require_login.</p> https://cve.radiocsirt.org/vuln/pysec-2014-64