zope -- expose RestructuredText functionality to untrusted users

A Zope Hotfix Alert reports: This hotfix resolves a security issue with docutils. Affected are possibly all Zope instances that expose RestructuredText functionalies to untrusted users through the web...

Debian DSA-055-1 : zope - remote unauthorized access

A new Zope hotfix has been released which fixes a problem in ZClasses. The README for the 2001-05-01 hotfix describes the problem as any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for...

Debian DSA-490-1 : zope - arbitrary code execution

A vulnerability has been discovered in the index support of the ZCatalog plug-in in Zope, an open source web application server. A flaw in the security settings of ZCatalog allows anonymous users to call arbitrary methods of catalog indexes. The vulnerability also allows untrusted code to do the...

Debian DSA-043-1 : zope

This advisory covers several vulnerabilities in Zope that have been addressed.Hotfix 08092000 'Zope security alert and hotfix product' The issue involves the fact that the getRoles method of user objects contained in the default UserFolder implementation returns a mutable Python type. Because the...

Zope < 2.1.7 DocumentTemplate Unauthorized Modification

Binary data 1444.prm...

Zope < 2.3.3 ZClass Permission Mapping Modification Local Privilege Escalation

Binary data 1446.prm...

Zope < 2.2.5 Multiple Vulnerabilities

Binary data 1445.prm...

[SECURITY] [DSA 490-1] New Zope packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 490-1 [email protected] http://www.debian.org/security/ Martin Schulze April 17th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 490-1] New Zope packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 490-1 [email protected] http://www.debian.org/security/ Martin Schulze April 17th, 2004 http://www.debian.org/security/faq -...

Zope < 2.6.3 Multiple Vulnerabilities

The remote web server is a version of Zope which is older than version 2.6.3. There are multiple security issues in all releases prior to version 2.6.3 or 2.7 BETA4 which can be exploited by an attacker to perform cross-site scripting attacks, obtain information about the remote host, or disable...

Zope Invalid Query Path Disclosure

The remote Zope web server may be forced into disclosing its physical path when calling 'Examples/ShoppingCart/addItems' with a blank quantity. Note that this install is also likely to be affected by several other vulnerabilities, although Nessus has not checked for them. C Tenable Network...

CVE-2002-0170

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration...

CVE-2000-1212

CVE-2000-1212 concerns Zope 2.2.0–2.2.4, where a data updating method on Image and File objects is not properly protected. This flaw enables attackers with DTML editing privileges to modify the raw data of these objects. The vulnerability is rooted in insufficient access controls on a data update...

CVE-2002-0687

Zope Server DoS via header injection (CVE-2002-0687) affects Zope versions 2.0 through 2.5.1 beta 1, where the "through the web code" capability allows untrusted users to crash the server by injecting malicious headers into a response. The connected advisories (GHSA-vwrc-g9q6-f675 and OSV) descri...

CVE-2002-0688

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes...

CVE-2002-0687

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers...

CVE-2002-0688

CVE-2002-0688 applies to the ZCatalog plug-in in Zope (versions 2.4.0–2.5.1). The flaw is a security-settings issue in ZCatalog that allows anonymous users and untrusted code to bypass access restrictions and invoke arbitrary methods of catalog indexes. Impact documented as remote access to catal...

CVE-2000-1211

Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities...

CVE-2000-1212

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects...

CVE-2002-0170

CVE-2002-0170 affects Zope 2.2.0 through 2.5.1. The underlying issue is improper verification of access for objects with proxy roles, which could allow some users to access documents contrary to the intended configuration. Several sources (GHSA/OSV, CVE records, and related advisories) corroborat...