Zope框架"cmd"参数远程命令执行漏洞

BUGTRAQ ID: 49857 CVE ID: CVE-2011-3587 Zope是一个开源的web应用服务器，主要用python写成 Zope在实现上存在远程命令执行漏洞，非法攻击者可利用此漏洞部署特制的Web请求并以Zope/Plone服务权限执行任意命令 0 Zope 2.13.9 Zope 2.13.8 Zope 2.13 Zope 2.12.19 Zope 2.12 Plone 4.x 厂商补丁： Zope ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.zope.org/ Exploit Title: Plone -...

Zope 2.6.1 空上传远程信息泄露漏洞

BUGTRAQ ID: 7998 Zope是一款WEB应用服务器。 Zope不正确处理上传文件参数为空的请求，远程攻击者可以利用这个漏洞获得路径敏感信息。 当用户调用上传操作，并且作为URI参数的目标文件为空时，Zope会产生错误，并返回包含敏感路径的信息给攻击者，攻击者利用此信息可对系统进行进一步攻击 0 Zope 2.6.1 厂商补丁： Zope ---- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.zope.org/...

Zope畸形XML-RPC请求导致远程信息泄露漏洞

BUGTRAQ ID: 5806 Zope是一款基于Python的开放源代码内容管理系统服务程序。 Zope没有正确处理XML-RPC请求，远程攻击者可以利用这个漏洞获得系统敏感信息。 攻击者构建畸形的XML-RPC请求给Zope服务器，由于Zope处理错误可导致Zope返回包含详细系统信息的错误页面，攻击者可以利用这些信息进一步对系统进行攻击 0 Zope Zope 2.5.1 Zope Zope 2.5.0 Zope Zope 2.4.4 b1 Zope Zope 2.4.3 Zope Zope 2.4.2 Zope Zope 2.4.1 Zope Zope 2.4.0 Zope...

Plone zope remote command execution vulnerability(python)-bug warning-the black bar safety net

Versions Affected without hotfix: Plone 4.0 through 4.0.9; Plone 4.1; Plone 4.2 a1 and a2; Zope 2.12. x and Zope 2.13. x. Versions Not Affected: Versions of Plone that use Zope other than Zope 2.12. x and Zope 2.13. x. Advisory/Hotfix: http://plone.org/products/plone/security/advisories/20110928...

Plone and Zope - Remote Command Execution

Plone and Zope - Remote Command Execution Exploit Title: Plone - Remote Command Execution Date: 12/21/2011 Author: Nick Miles www.npenetrable.com Tested on: 12/21/2011 CVE : CVE-2011-3587 Versions Affected without hotfix: Plone 4.0 through 4.0.9; Plone 4.1; Plone 4.2 a1 and a2; Zope 2.12.x and Zo...

Plone and Zope - Remote Command Execution

Exploit Title: Plone - Remote Command Execution Date: 12/21/2011 Author: Nick Miles www.npenetrable.com Tested on: 12/21/2011 CVE : CVE-2011-3587 Versions Affected without hotfix: Plone 4.0 through 4.0.9; Plone 4.1; Plone 4.2 a1 and a2; Zope 2.12.x and Zope 2.13.x. Versions Not Affected: Versions...

Plone and Zope Remote Command Execution PoC

Exploit for multiple platform in category web applications Exploit Title: Plone - Remote Command Execution Date: 12/21/2011 Author: Nick Miles www.npenetrable.com Tested on: 12/21/2011 CVE : CVE-2011-3587 Versions Affected without hotfix: Plone 4.0 through 4.0.9; Plone 4.1; Plone 4.2 a1 and a2;...

Plone / Zope Remote Command Execution

Exploit Title: Plone - Remote Command Execution Date: 12/21/2011 Author: Nick Miles www.npenetrable.com Tested on: 12/21/2011 CVE : CVE-2011-3587 Versions Affected without hotfix: Plone 4.0 through 4.0.9; Plone 4.1; Plone 4.2 a1 and a2; Zope 2.12.x and Zope 2.13.x. Versions Not Affected: Versions...

Plone Request Parsing Remote Command Execution

The version of Plone hosted on the remote web server has a flaw that allows arbitrary access to Python modules. Using a specially crafted URL, this can allow an unauthenticated, remote attacker the ability to run arbitrary commands on the system through the Python 'os' module in the context of th...

CVE-2011-3587

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules...

Design/Logic Flaw

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules...

PYSEC-2011-26

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules...

Immunity Canvas: PLONE

Name| plone ---|--- CVE| CVE-2011-3587 Exploit Pack| CANVAS Description| Plone Zope Remote Command Execution Notes| CVE Name: CVE-2011-3587 Notes: Vulnerable versions include: Plone 4.0 through 4.0.9; Plone 4.1; Plone 4.2 a1 and a2; Zope 2.12.x and Zope 2.13.x. Repeatability: Infinite CVE Url:...

DSquare Exploit Pack: D2SEC_ZOPEPLONE

Name| d2seczopeplone ---|--- CVE| CVE-2011-3587 Exploit Pack| D2ExploitPack Description| Zope/Plone Remote Code Execution Vulnerability Notes|...

PYSEC-2011-26

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules...

CVE-2011-3587

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules...

CVE-2011-3587

CVE-2011-3587 affects Zope 2.12.x and 2.13.x, as used by Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2. The underlying issue is an unspecified vulnerability in the p_ class in OFS/misc_.py and the use of Python modules that allows a remote attacker to execute arbitrary commands. Affected ...

Plone and Zope XMLTools Remote Command Execution

Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p class in OFS/misc.py and the use of Python modules. Module Options msf use...

PYSEC-2011-32

Withdrawn as duplicate of PYSEC-2011-25. Unspecified vulnerability in 1 Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and 2 PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious...

PYSEC-2011-32

Withdrawn as duplicate of PYSEC-2011-25. Unspecified vulnerability in 1 Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and 2 PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious...