CVE-2001-0568

Digital Creations Zope 2.3.1 b1 and earlier allows a local attacker Zope user with through-the-web scripting capabilities to alter ZClasses class attributes...

CVE-2001-0569

Digital Creations Zope 2.3.1 b1 and earlier contains a problem in the method return values related to the classes 1 ObjectManager, 2 PropertyManager, and 3 PropertySheet...

CVE-2001-0567

Digital Creations Zope 2.3.2 and earlier allows a local attacker to gain additional privileges via the changing of ZClass permission mappings for objects and methods in the ZClass...

Zope ZClass Modification Local DoS

The remote web server is Zope 2.2.5. Such versions allow any Zope user to create a denial of service by modifying Zope data structures, thus rendering the site unusable. Since Nessus solely relied on the version number of the server, consider this a false positive if the hotfix has already been...

CVE-2001-0568

Digital Creations Zope 2.3.1 b1 and earlier allows a local attacker Zope user with through-the-web scripting capabilities to alter ZClasses class attributes...

CVE-2001-0569

Zope 2.3.1b1 and earlier are affected by a vulnerability in the return values of ObjectManager, PropertyManager, and PropertySheet, per CVE-2001-0569. Advisories (Debian DSA-043-1, Mandrake MDKSA-2001:025) describe hotfixes and recommend upgrading to patched Zo pe packages; the mutability of meth...

CVE-2001-0568

CVE-2001-0568 affects Digital Creations Zope 2.3.1 b1 and earlier. A local attacker with through-the-web scripting capabilities can modify ZClasses class attributes, enabling possible unauthorized changes within the Zope instance. The vulnerability is documented in multiple advisories (Zope hotfi...

CVE-2001-0569

Digital Creations Zope 2.3.1 b1 and earlier contains a problem in the method return values related to the classes 1 ObjectManager, 2 PropertyManager, and 3 PropertySheet...

[SECURITY] [DSA-055-1] zope remote unauthorized access

Package : zope Problem type : remote unauthorized access Debian-specific: no A new Zope hotfix has been released which fixes a problem in ZClasses. The README for the 2001-05-01 hotfix describes the problem as any user can visit a ZClass declaration and change the ZClass permission mappings for...

CVE-2001-0128

Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges...

CVE-2001-0128

Zope before 2.2.4 contains a bug in how local roles are computed, enabling bypass of access restrictions and privilege escalation. The issue is documented across multiple sources (NVD/CVE entry and Mandrake MDKSA-2000:086) and affects Zope 2.2.4 and earlier. Remediation is to apply the update to ...

[SECURITY] [DSA 043-2] New versions of Zope fix vulnerabilities

---------------------------------------------------------------------------- Debian Security Advisory DSA-043-2 [email protected] http://www.debian.org/security/ Martin Schulze April 26, 2001 - ---------------------------------------------------------------------------- Packages : zope...

CVE-2001-0128

Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges...

[SECURITY] [DSA 043-1] New Zope packages available

---------------------------------------------------------------------------- Debian Security Advisory DSA-043-1 [email protected] http://www.debian.org/security/ Martin Schulze March 9, 2001 - ---------------------------------------------------------------------------- Packages : zope...

[RHSA-2001:021-06] New Zope packages are available

--------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: New Zope packages are available Advisory ID: RHSA-2001:021-06 Issue date: 2001-02-24 Updated on: 2001-02-26 Product: Red Hat Powertools Keywords: Cross references: Obsoletes:...

FreeBSD-SA-01:06.zope

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:06 Security Advisory FreeBSD, Inc. Topic: zope vulnerability allows escalation of privileges Category: ports Module: zope Announced: 2001-01-15 Credits: Erik Enge Affects...

Zope DTML Role Issue

For those of you that haven't seen it, this is the advisory that came across the zope list regarding the DTML role issue. Begin Advisory Brian Lloyd [email protected] Fri, 8 Dec 2000 15:48:52 -0500 Hi all, Aleksander Salwa has brought a security issue to our attention that affects all Zope...

[SECURITY] [DSA-007-1] insufficient protection for zope Image and File objects

Package : zope Problem type : insufficient protection Debian-specific: no A busy week for the Zope team: on Monday another security alert was released revealing a potential problem found by Peter Kelly. This problem involved incorrect protection of data updating for Image and File objects: any us...

[SECURITY] [DSA-006-1] zope privilege escalation

Package : zope Problem type : privilege escalation Debian-specific: no Last week a Zope security advisory was released which indicated Erik Enge found a problem in the way Zope calculates roles. In some situations Zope checked the wrong folder hierarchy which could cause it to grant local roles...

Zope Image and File Update Data Protection Bypass

According to its banner, the remote web server is Zope 2.2.5. Such versions suffer from a security issue involving incorrect protection of a data updating method on Image and File objects. Because the method is not correctly protected, it is possible for users with DTML editing privileges to upda...