https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 23:18:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-237366 EUVD-2026-237366 https://cve.radiocsirt.org/vuln/euvd-2026-237366 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23599 <p>Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user&#39;s cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.</p> <p>Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user&#39;s cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-23599 https://cve.radiocsirt.org/vuln/ghsa-g4c2-ghfg-g5rh <p><strong>Affected:</strong> PyPI: Products.ATContentTypes</p> <p>### Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings.</p> <p>### Patches A new version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7.</p> <p>Note that the Products.CMFPlone package has the same problem in the 4.3 series. `plone.app.contenttypes` has the same problem in all versions, see [advisory](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x). For all unpatched versions of the three packages, you can use the following workaround.</p> <p>### Workaround Make sure the image_view_fullscreen page is not stored in the cache. In Plone:</p> <p>* Login as Manager and go to Site Setup. * Go to the &#39;Caching&#39; control panel. If this does not exist, or &#39;Enable caching&#39; is not checked, you should normally not be vulnerable. * Click on the tab &#39;Caching operations&#39;. * Under &#39;Legacy template mappings&#39; locate the ruleset &#39;Content item view&#39;. * From the last column (&#39;Templates&#39;) remove &#39;image_view_fullscreen&#39;. * Click on Save.</p> <p>### Reporter This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Sec…</p> <p><strong>Affected:</strong> PyPI: Products.ATContentTypes</p> <p>### Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings.</p> <p>### Patches A new version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7.</p> <p>Note that the Products.CMFPlone package has the same problem in the 4.3 series. `plone.app.contenttypes` has the same problem in all versions, see [advisory](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x). For all unpatched versions of the three packages, you can use the following workaround.</p> <p>### Workaround Make sure the image_view_fullscreen page is not stored in the cache. In Plone:</p> <p>* Login as Manager and go to Site Setup. * Go to the &#39;Caching&#39; control panel. If this does not exist, or &#39;Enable caching&#39; is not checked, you should normally not be vulnerable. * Click on the tab &#39;Caching operations&#39;. * Under &#39;Legacy template mappings&#39; locate the ruleset &#39;Content item view&#39;. * From the last column (&#39;Templates&#39;) remove &#39;image_view_fullscreen&#39;. * Click on Save.</p> <p>### Reporter This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Sec…</p> https://cve.radiocsirt.org/vuln/ghsa-g4c2-ghfg-g5rh https://cve.radiocsirt.org/vuln/gsd-2022-23599 gsd-2022-23599 https://cve.radiocsirt.org/vuln/gsd-2022-23599 https://cve.radiocsirt.org/vuln/pysec-2022-21 <p><strong>Affected:</strong> PyPI: products-atcontenttypes</p> <p>Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user&#39;s cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.</p> <p><strong>Affected:</strong> PyPI: products-atcontenttypes</p> <p>Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user&#39;s cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.</p> https://cve.radiocsirt.org/vuln/pysec-2022-21