{"action":"Upgrade plone to 4.1.1 or later.","affected":[{"fixed":"4.1.1","introduced":"0"}],"component":"plone","cve_ids":["CVE-2011-1949"],"ecosystem":"PyPI","epss":0.01872,"exploited":false,"fixed_versions":["4.1.1"],"ghsa_id":"GHSA-h6hq-c896-w882","id":"tcs_01M5KG5FVXZTQJN2HS2E053FQS","modified_at":"2023-11-08T03:56:59.641619Z","published_at":"2011-06-06T19:55:00Z","references":["https://osv.dev/vulnerability/PYSEC-2011-15","http://secunia.com/advisories/44775","http://plone.org/products/plone/security/advisories/CVE-2011-1949","http://www.securityfocus.com/bid/48005","http://secunia.com/advisories/44776","http://osvdb.org/72728","http://securityreason.com/securityalert/8269","https://exchange.xforce.ibmcloud.com/vulnerabilities/67694","http://www.securityfocus.com/archive/1/518155/100/0/threaded","https://github.com/advisories/GHSA-h6hq-c896-w882"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2011-15","url":"https://osv.dev/vulnerability/PYSEC-2011-15"}],"summary":"Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unsp"}