Zope vulnerabilities

Products

• Zope 36
• Accesscontrol 4
• Zodb 4
• Restrictedpython 3
• Products.pluggableauthservice 2

Newest

• zope accesscontrol User data deletion by anoynmous users in Zope CVE-2024-51734 Fix available 8.7 HighNovember 4, 2024
• zope restrictedpython RestrictedPython information leakage via `AttributeError.obj` and the `string` module CVE-2024-47532 Fix available 8.7 HighSeptember 30, 2024
• zope sqlalchemyda, zopefoundation products.sqlalchemyda +1 more Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution CVE-2024-24811 Fix available 9.8 CriticalFebruary 7, 2024
• zope Zope management interface vulnerable to stored cross site scripting via the title property CVE-2023-44389 Fix available 3.1 LowOctober 4, 2023
• zope Zope vulnerable to Stored Cross Site Scripting with SVG images CVE-2023-42458 Fix available 3.7 LowSeptember 21, 2023
• zope accesscontrol, zope +1 more Information disclosure through Python's "format" functionality in Zope AccessControl CVE-2023-41050 Fix available 6.8 MediumSeptember 6, 2023
• zope restrictedpython Sandbox escape via various forms of "format" in RestrictedPython CVE-2023-41039 Fix available 8.3 HighAugust 30, 2023
• zope restrictedpython RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape CVE-2023-37271 Fix available 8.4 HighJuly 10, 2023
• zope products.cmfcore zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module CVE-2023-36814 Fix available 7.5 HighJuly 3, 2023
• zope, zope accesscontrol +1 more Remote Code Execution via Script (Python) objects under Python 3 CVE-2021-32811 Fix available 7.5 HighAugust 2, 2021
• zope accesscontrol Remote Code Execution via unsafe classes in otherwise permitted modules CVE-2021-32807 Fix available 4.4 MediumJuly 30, 2021
• zope grok Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress:... CVE-2021-36089 Fix available 7.8 HighJuly 1, 2021
• zope Remote Code Execution via traversal in TAL expressions CVE-2021-32674 Fix available 8.8 HighJune 8, 2021
• plone, zope +1 more Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone CVE-2021-33507 Fix available 6.1 MediumMay 21, 2021
• zope, plone +1 more Remote Code Execution via traversal in TAL expressions CVE-2021-32633 Fix available 6.8 MediumMay 21, 2021
• zope products.genericsetup Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup CVE-2021-21360 Fix available 5.3 MediumMarch 9, 2021
• zope products.pluggableauthservice URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService CVE-2021-21337 Public exploitFix available 5.7 MediumMarch 8, 2021
• zope products.pluggableauthservice, plone +1 more Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager CVE-2021-21336 Fix available 6.5 MediumMarch 8, 2021
• zope, zope zope2, zope3 +1 more Zope XSS Vulnerability CVE-2011-4924 Fix available 6.1 MediumNovember 25, 2019
• plone, zope management interface +1 more Plone vulnerable to cross-site request forgery CVE-2015-7293 Public exploitFix available 8.8 HighSeptember 25, 2017
• zope Zope Cross-site scripting (XSS) vulnerability in ZMI pages CVE-2009-5145 Fix available 6.1 MediumAugust 7, 2017
• plone, zope +1 more Plone and Zope2 do not reseed pseudo-random number generator CVE-2012-6661 Fix available 5.0 MediumNovember 3, 2014
• plone, zope +1 more Plone and Zope2 affected by Race Condition CVE-2012-5507 Fix available 4.3 MediumSeptember 30, 2014
• plone, zope +1 more Plone and Zope2 vulnerable to unauthorized access to restricted attributes CVE-2012-5489 Fix available 6.5 MediumSeptember 30, 2014
• plone, zope +1 more HTTP header injection in Plone and Zope2 CVE-2012-5486 Fix available 6.4 MediumSeptember 30, 2014
• plone, zope +1 more Zope Command Execution Vulnerability CVE-2011-3587 Public exploitFix available EPSS 78.1% 9.3 HighOctober 10, 2011
• plone, zope, plone hotfix 20110720 +2 more High severity vulnerability that affects Plone and Zope2 CVE-2011-2528 Fix available 7.5 HighJuly 19, 2011
• zope zodb Zope Object Database Denial of Service vulnerability CVE-2010-3495 Fix available 4.3 MediumOctober 19, 2010
• zope Zope Denial of Service (DoS) vulnerability in ZServer CVE-2010-3198 Fix available 4.3 MediumSeptember 8, 2010
• zope Moderate severity vulnerability that affects Zope2 CVE-2010-1104 Fix available 4.3 MediumMarch 25, 2010
• zope zodb Zope Object Database (ZODB) Arbitrary files reading and deletion CVE-2009-2701 Fix available 6.0 MediumSeptember 8, 2009
• zope zodb Zope Object Database (ZODB) Authentication bypass in ZEO storage servers CVE-2009-0669 Fix available 7.5 HighAugust 7, 2009
• zope zodb Zope Object Database (ZODB) vulnerable to arbitrary Python code execution in ZEO storage servers CVE-2009-0668 Fix available 6.5 MediumAugust 7, 2009
• zope PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote... CVE-2008-5102 Public exploit 4.0 MediumNovember 17, 2008
• zope Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to... CVE-2007-0240 Fix available 4.3 MediumMarch 22, 2007
• zope Zope allows remote attackers to read arbitrary files CVE-2006-4684 Fix available 5.0 MediumSeptember 13, 2006
• zope Zope allows local users to read arbitrary files CVE-2006-3458 Fix available 2.1 LowJuly 7, 2006
• zope, debian linux +1 more docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include... CVE-2005-3323 Fix available 7.5 HighOctober 27, 2005
• zope ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions CVE-2002-0688 Fix available 7.5 HighJuly 23, 2002
• zope Zope Server vulnerable to DoS via header injection CVE-2002-0687 Fix available 5.0 MediumJuly 23, 2002
• zope Zope does not properly verify the access for objects with proxy roles CVE-2002-0170 Fix available 7.5 HighApril 22, 2002
• zope Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods... CVE-2001-1278 7.5 HighOctober 10, 2001
• zope Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods... CVE-2001-1227 7.5 HighOctober 10, 2001
• zope Digital Creations Zope 2.3.2 and earlier allows a local attacker to gain additional privileges... CVE-2001-0567 4.6 MediumAugust 14, 2001
• zope Digital Creations Zope 2.3.1 b1 and earlier contains a problem in the method return values... CVE-2001-0569 2.1 LowJuly 27, 2001
• zope Digital Creations Zope 2.3.1 b1 and earlier allows a local attacker (Zope user) with through-the... CVE-2001-0568 2.1 LowJuly 27, 2001
• zope, conectiva linux, freebsd +2 more +4 more Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass... CVE-2001-0128 7.2 HighMarch 12, 2001
• zope Zope allows attackers to modify raw image and file data CVE-2000-1212 5.0 MediumDecember 18, 2000
• zope Zope does not properly perform security registration for legacy names CVE-2000-1211 7.5 HighDecember 16, 2000
• zope Zope does not properly restrict access to the getRoles method CVE-2000-0725 Fix available 7.2 HighOctober 13, 2000
• Show olderLoading…