CVE-2000-1211

The CVE concerns Zope 2.2.0 through 2.2.4, where security registrations for legacy names of object constructors (e.g., DTML method objects) are not performed correctly. This could allow attackers to perform unauthorized activities due to improper access control on constructor names. The issue is ...

Zope Malformed XML RPC Request Path Disclosure

There is a minor security problem in all releases of Zope prior to version 2.5.1b1 - they reveal the installation path when an invalid XML RPC request is sent. C Tenable Network Security, Inc. http://collector.zope.org/Zope/359 include"compat.inc"; ifdescription scriptid11234; scriptversion "1.19...

Zope 2.x - Incorrect XML-RPC Request Information Disclosure

Zope 2.x - Incorrect XML-RPC Request Information Disclosure source: https://www.securityfocus.com/bid/5806/info A vulnerability has been reported for Zope 2.5.1 and earlier. Reportedly, Zope does not handle XML-RPC requests properly. Specially crafted XML-RPC requests may cause Zope to respond to...

Zope 2.x - Incorrect XML-RPC Request Information Disclosure

source: https://www.securityfocus.com/bid/5806/info A vulnerability has been reported for Zope 2.5.1 and earlier. Reportedly, Zope does not handle XML-RPC requests properly. Specially crafted XML-RPC requests may cause Zope to respond to a request with an error page with system specific details...

CVE-2002-0687

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers...

CVE-2002-0688

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes...

CVE-2001-1227

CVE-2001-1227 affects Zope up to version prior to 2.2.4. The vulnerability arises when partially trusted users can bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags. Publicly available details in connected advisories confirm the root ...

CVE-2001-1227

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

CVE-2001-1278

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

CVE-2001-1278

Zope vulnerable before 2.2.4: partially trusted users could bypass security checks by invoking methods via the fmt attribute of dtml-var tags. The Mandrake MDKSA-2001:080 hotfix addresses this DTML scripting issue, remedying the fmt access problem and preventing unauthorized method calls. The vul...

CVE-2002-0170

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration...

CVE-2001-0567

Digital Creations Zope 2.3.2 and earlier allows a local attacker to gain additional privileges via the changing of ZClass permission mappings for objects and methods in the ZClass...

CVE-2001-0567

The CVE concerns Zope 2.3.2 and earlier, where a local attacker can gain additional privileges by altering ZClass permission mappings for objects and methods within a ZClass. Public sources in connected documents corroborate that the vulnerability is tied to Zope’s ZClass permission mappings and ...

Дырка в zope :)

Класс DocumentTemplate содержит методы, которые позволяют изменить характеристики класса удаленно через DTML без авторизации. Кроме того проблеммы с классом ZClasses. Часть небезопасных методов могут быть вызваны ограниченным пользователем...

MDKSA-2001:080 - Zope update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrake Linux Security Update Advisory Package name: Zope Date: October 15th, 2001 Advisory ID: MDKSA-2001:080 Affected versions: 7.1, 7.2, Corporate Server 1.0.1 Problem Description: A new Zope hotfix is available that fixes a problem with DTML...

security flaw

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

Moderate: Red Hat Security Advisory: : New Zope packages are available

New Zope packages are available which fix a security flaw with DTML scripting. The updated packages include a "hotfix" product which addresses a security problem with DTML scripting, as described in the Hotfix2001-09-28 README.txt file: "The issue involves the fmt attribute of dtml-var tags...

CVE-2001-1227

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

CVE-2001-1278

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

Zope < 2.3.3 ZClass Permission Mapping Modification Local Privilege Escalation

The remote web server uses a version of Zope which is older than version 2.3.3. In such versions, any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for unauthorized access within the Zope...