Richard Mitchell

**Name of the Vulnerable Software and Affected Versions** Plone versions prior to 4.2.3 Plone versions 4.3 prior to beta 1 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This could potentially affect a large number of devices worldwide, although the exact number is not specified. **Recommendations** For Plone versions prior to 4.2.3, update to version 4.2.3 or later to resolve the issue. For Plone versions 4.3 prior to beta 1, update to beta 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `kssdevel.py` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Plone versions prior to 4.2.3 Plone version 4.3 before beta 1 **Description** The issue allows remote attackers to obtain metadata about hidden objects via a crafted URL. This is possible due to a flaw in the `uid catalog.py` component. **Recommendations** For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later. As a temporary workaround, consider restricting access to the `uid catalog.py` component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Kupu in Plone versions prior to 4.0 **Description** The issue allows remote attackers to cause a denial of service, specifically a ZServer thread lock, by using a crafted URL. **Recommendations** For versions prior to 4.0, update to version 4.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Plone versions prior to 4.2.3 Plone version 4.3 before beta 1 **Description** The issue allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection. This is related to the queryCatalog.py script. **Recommendations** For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

**Name of the Vulnerable Software and Affected Versions** Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1 **Description** The issue allows remote attackers to cause a denial of service, specifically memory consumption, via a large value. This is related to the `formatColumns` function. **Recommendations** For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later. As a temporary workaround, consider restricting access to the `formatColumns` function until a patch is available.