(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed).
Vector
NETWORK
Complexity
MEDIUM
Authentication
SINGLE_INSTANCE
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL
Plone Plone 4.2.4 (not an official CPE)
JSON-C Project JSON-C 0.1
Plone Plone 4.2.5 (not an official CPE)
JSON-C Project JSON-C 0.12
Plone Plone 4.2.2 (not an official CPE)
JSON-C Project JSON-C 0.11
Plone Plone 4.2.3 (not an official CPE)
JSON-C Project JSON-C 0.7
JS-YAML Project JS-YAML 0.3.3
Juniper DX
JS-YAML Project JS-YAML 0.3.4
JS-YAML Project JS-YAML 0.3.1
Juniper FIPS Infranet Controller 6500 (FIPS IF6500)
JS-YAML Project JS-YAML 1.0.3
JS-YAML Project JS-YAML 0.3.2
Juniper DX 5.1
JS-YAML Project JS-YAML 2.0.0
Plone Plone 4.3 (not an official CPE)
Plone Plone 4.2 (not an official CPE)
Juniper FIPS Secure Access 4000 appliance (FIPS SA4000)
JS-YAML Project JS-YAML 1.0.2
Juniper FIPS Secure Access 4500appliance (FIPS SA4500)
JS-YAML Project JS-YAML 1.0.1
Juniper FIPS Secure Access 6500 appliance (FIPS SA6500)
JS-YAML Project JS-YAML 1.0.0
Juniper Connect Tools 1.0.0
JS-YAML Project JS-YAML 0.3.7
JSON-C Project JSON-C 0.8
JSON-C Project JSON-C 0.9
jspautsch FirstLastNames plugin for Vanilla Forums 1.1.1
JSON-C Project JSON-C 0.10
Junefabrics Pdanet For Android 2.45
Plone Plone 4.2.1 (not an official CPE)
JS-YAML Project JS-YAML 2.0.2
JS-YAML Project JS-YAML 2.0.3
JS-YAML Project JS-YAML 2.0.4
Juniper FIPS Secure Access 6000 appliance (FIPS SA6000)
JS-YAML Project JS-YAML 0.3.0
JSON-C Project JSON-C 0.6
JSON-C Project JSON-C 0.4
JSON-C Project JSON-C 0.2
JSON-C Project JSON-C 0.3
Plone Plone 4.3.1 (not an official CPE)
JS-YAML Project JS-YAML 2.0.1
JRuby 1.6.7.2
JS-YAML Project JS-YAML 0.3.6
JSON-C Project JSON-C 0.5
JS-YAML Project JS-YAML 0.2.1
JS-YAML Project JS-YAML 0.2.2
JRuby 1.6.8
JS-YAML Project JS-YAML 0.2.0
JS-YAML Project JS-YAML 0.3.5
Improper Input Validation (ID 20)
Related CAPEC 58
Buffer Overflow via Environment Variables (CAPEC-ID 10)
Server Side Include (SSI) Injection (CAPEC-ID 101)
Cross Zone Scripting (CAPEC-ID 104)
Cross Site Scripting through Log Files (CAPEC-ID 106)
Command Line Execution through SQL Injection (CAPEC-ID 108)
Object Relational Mapping Injection (CAPEC-ID 109)
SQL Injection through SOAP Parameter Tampering (CAPEC-ID 110)
Subverting Environment Variable Values (CAPEC-ID 13)
Format String Injection (CAPEC-ID 135)
LDAP Injection (CAPEC-ID 136)
Relative Path Traversal (CAPEC-ID 139)
Client-side Injection-induced Buffer Overflow (CAPEC-ID 14)
Variable Manipulation (CAPEC-ID 171)
Embedding Scripts in Non-Script Elements (CAPEC-ID 18)
Flash Injection (CAPEC-ID 182)
Cross-Site Scripting Using Alternate Syntax (CAPEC-ID 199)
Exploiting Trust in Client (aka Make the Client Invisible) (CAPEC-ID 22)
XML Nested Payloads (CAPEC-ID 230)
XML Oversized Payloads (CAPEC-ID 231)
Filter Failure through Buffer Overflow (CAPEC-ID 24)
Cross-Site Scripting via Encoded URI Schemes (CAPEC-ID 244)
XML Injection (CAPEC-ID 250)
Environment Variable Manipulation (CAPEC-ID 264)
Global variable manipulation (CAPEC-ID 265)
Leverage Alternate Encoding (CAPEC-ID 267)
Fuzzing (CAPEC-ID 28)
Using Leading 'Ghost' Character Sequences to Bypass Input Filters (CAPEC-ID 3)
Accessing/Intercepting/Modifying HTTP Cookies (CAPEC-ID 31)
Embedding Scripts in HTTP Query Strings (CAPEC-ID 32)
MIME Conversion (CAPEC-ID 42)
Exploiting Multiple Input Interpretation Layers (CAPEC-ID 43)
Buffer Overflow via Symbolic Links (CAPEC-ID 45)
Overflow Variables and Tags (CAPEC-ID 46)
Buffer Overflow via Parameter Expansion (CAPEC-ID 47)
Signature Spoof (CAPEC-ID 473)
XML Client-Side Attack (CAPEC-ID 484)
Embedding NULL Bytes (CAPEC-ID 52)
Postfix, Null Terminate, and Backslash (CAPEC-ID 53)
Simple Script Injection (CAPEC-ID 63)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (CAPEC-ID 64)
SQL Injection (CAPEC-ID 66)
String Format Overflow in syslog() (CAPEC-ID 67)
Blind SQL Injection (CAPEC-ID 7)
Using Unicode Encoding to Bypass Validation Logic (CAPEC-ID 71)
URL Encoding (CAPEC-ID 72)
User-Controlled Filename (CAPEC-ID 73)
Using Escaped Slashes in Alternate Encoding (CAPEC-ID 78)
Using Slashes in Alternate Encoding (CAPEC-ID 79)
Buffer Overflow in an API Call (CAPEC-ID 8)
Using UTF-8 Encoding to Bypass Validation Logic (CAPEC-ID 80)
Web Logs Tampering (CAPEC-ID 81)
XPath Injection (CAPEC-ID 83)
AJAX Fingerprinting (CAPEC-ID 85)
Embedding Script (XSS) in HTTP Headers (CAPEC-ID 86)
OS Command Injection (CAPEC-ID 88)
Buffer Overflow in Local Command-Line Utilities (CAPEC-ID 9)
XSS in IMG Tags (CAPEC-ID 91)
XML Parser Attack (CAPEC-ID 99)