PYSEC-2010-33

Withdrawn as duplicate of PYSEC-2010-32 ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service crash of worker threads via vectors that trigger uncaught exceptions...

PYSEC-2010-32

ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service crash of worker threads via vectors that trigger uncaught exceptions...

Code injection

ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service crash of worker threads via vectors that trigger uncaught exceptions...

CVE-2010-3198

ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service crash of worker threads via vectors that trigger uncaught exceptions...

PYSEC-2010-32

ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service crash of worker threads via vectors that trigger uncaught exceptions...

CVE-2010-3198

The CVE-2010-3198 issue concerns ZServer in Zope, affecting Zope 2.10.x prior to 2.10.12 and 2.11.x prior to 2.11.7. A remote attacker can trigger uncaught exceptions that cause a denial of service by crashing worker threads. The available connected documents confirm this DoS impact and the affec...

Zope Unspecified Denial Of Service Vulnerability

Zope is prone to an unspecified denial-of-service vulnerability. An attacker can exploit this issue to cause the vulnerable application to crash, denying service to legitimate users. Versions prior to Zope 2.10.12 and Zope 2.11.7 are vulnerable. OpenVAS Vulnerability Test $Id: gbzope42939.nasl 53...

Zope < 2.10.12, 2.11.x < 2.11.7 DoS Vulnerability

Zope is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zope:zope"; if descriptio...

Debian DSA-2096-1 : zope-ldapuserfolder - missing input validation

Jeremy James discovered that in LDAPUserFolder, a Zope extension used to authenticate against an LDAP server, the authentication code does not verify the password provided for the emergency user. Malicious users that manage to get the emergency user login can use this flaw to gain administrative...

[SECURITY] [DSA 2096-1] New zope-ldapuserfolder packages fix authentication bypass

------------------------------------------------------------------------ Debian Security Advisory DSA-2096-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff August 24, 2010 http://www.debian.org/security/faq -...

DSA-2096-1 zope-ldapuserfolder - authentication

Bulletin has no description...

CVE-2010-2944

The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges...

Default credentials

The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges...

CVE-2010-2944

The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges...

CVE-2010-2944

CVE-2010-2944 affects zope-ldapuserfolder (LDAPUserFolder/LDAPUserFolder.py) with version 2.9-1, where the authentication code does not verify the emergency account password. This allows remote attackers to gain privileges on the Zope instance. Debian’s DSA-2096-1 fixes the issue by upgrading to ...

CVE-2010-1104

Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

Cross site scripting

Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

CVE-2010-1104

Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

CVE-2010-1104

CVE-2010-1104 is an XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3.** The issue arises from how error messages are sanitized, allowing remote attackers to inject arbitrary web script or HTML via those error...

CVE-2010-1104

Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...