700 matches found
CVE-2021-32633
CVE-2021-32633 affects Zope prior to versions 4.6 and 5.2, where untrusted modules can indirectly access Python modules available for direct use, enabling unauthenticated or low-privileged users who can edit Zope Page Templates to exploit web-exposed templates. The issue arises from how Zope hand...
Zope 跨站脚本漏洞
Zope is a set of object-oriented, open source web application servers written in the Python language from the Zope ZOPE community. A cross-site scripting vulnerability exists in Zope Products.CMFCore before 2.5.1 and PluggableAuthService before 2.6.2, which stems from allowing reflection of XSS...
Zope 路径遍历漏洞
Zope is a set of object-oriented, open source web application servers written in the Python language by the Zope ZOPE community. A security vulnerability exists in Zope in versions prior to 4.6 and 5.2 that allows untrusted users to trigger the vulnerability by adding sites that edit Zope page...
CVE-2021-21360
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Gener...
PYSEC-2021-43
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Gener...
CVE-2021-21360
CVE-2021-21360 affects the Products.GenericSetup mini-framework used with Zope. Affected versions are before 2.1.1 and allow anonymous visitors to view log and snapshot files generated by the Generic Setup Tool (information disclosure). The issue has been fixed in version 2.1.1.remediation steps ...
CVE-2021-21336
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this...
CVE-2021-21337
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...
CVE-2021-21336
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this...
Information disclosure
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this...
PYSEC-2021-45
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...
Open redirect
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a differe...
PYSEC-2021-44
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this...
CVE-2021-21337
CVE-2021-21337 affects the PluggableAuthService login flow in Products.PluggableAuthService (Zope). Versions before 2.6.0 are vulnerable to an open redirect via a crafted login/redirect, e.g., altering the login flow’s came_from parameter to attacker-controlled sites. The issue is fixed in 2.6.1;...
CVE-2021-21336
CVE-2021-21336 affects the Plone/Zope component Products.PluggableAuthService. Before version 2.6.0, there is an information-disclosure vulnerability that allows listing the names of roles defined in the ZODB Role Manager plugin when the site uses this plugin. The issue has been fixed in version ...
CVE-2021-21336 Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this...
Products.PluggableAuthService 信息泄露漏洞
Jens Vagelpohl Products.PluggableAuthService is an open source application by Jens Vagelpohl. The product defines a fully pluggable user folder for use by all Zope sites. An information disclosure vulnerability exists in Products.PluggableAuthService that allows anyone to list the names of roles...
VulnCheck KEV: CVE-2011-3587
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules...
