Zope Image and File Update Data Protection Bypass

According to its banner, the remote web server is Zope 2.2.5. Such versions suffer from a security issue involving incorrect protection of a data updating method on Image and File objects. Because the method is not correctly protected, it is possible for users with DTML editing privileges to upda...

CVE-2000-1212

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects...

CVE-2000-1212: Undefined Security Weakness

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects...

CVE-2000-1211

Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities...

CVE-2000-1211: Undefined Security Weakness

Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities...

CVE-2000-0725

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request...

CVE-2000-0725

CVE-2000-0725 affects Zope prior to 2.2.1. The vulnerability arises in the getRoles method, where access is insufficiently restricted, allowing a user who can edit DTML to modify the roles list included in a request and thereby add or modify roles. The issue is described across multiple connected...

CVE-2000-0483

The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization...

CVE-2000-0725

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request...

CVE-2000-0483

The CVE-2000-0483 entry concerns the Zope DocumentTemplate package in Zope 2.2 and earlier. The issue allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization (unauthenticated write), representing a potential for content tampering. The root cause is a lack of proper a...

CVE-2000-0483: Undefined Security Weakness

The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization...

CVE-2000-0725: Undefined Security Weakness

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request...

[SECURITY] new version of zope released (updated)

Package: zope Vulnerability type: remote unprivileged access Debian-specific: no On versions of Zope prior to 2.2.1 it was possible for a user with the ability to edit DTML to gain unauthorized access to extra roles during a request. A fix was previously announced in the Debian zope package...

[SECURITY] new version of zope released (updated)

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Michael Stone August 21, 2000 - ------------------------------------------------------------------------ Package: zope Vulnerability type: remote...

FreeBSD-SA-00:38.zope

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:38 Security Advisory FreeBSD, Inc. Topic: zope port allows remote modification of DTML documents Category: ports Module: zope Announced: 2000-08-14 Credits: Unknown...

[SECURITY] new version of zope released

Package: zope Vulnerability type: remote unprivileged access Debian-specific: no On versions of Zope prior to 2.2beta1 it was possible for a user with the ability to edit DTML can gain unauthorized access to extra roles during a request. Debian 2.1 slink did not include zope, and is not vulnerabl...

[SECURITY] new version of zope released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Michael Stone August 11, 2000 - ------------------------------------------------------------------------ Package: zope Vulnerability type: remote...

Linux news 17.07.00

Linux Kernel pre-patch 2.4.0 test5-pre1 Вышел первый пререлиз пятого тестового ядра Linux - Linux Kernel 2.4.0. Подробнее: ftp://ftp.funet.fi/pub/linux/kernel/testing Linux Kernel 2.2.17pre12 Вышел очередной пререлиз нового стабильного ядра Linux - Linux Kernel 2.2.17. Подробнее:...

Linux news 26.06.00

Ядро 2.2.17pre6 Alan Cox анонсировал новую pre версию следующего стабильного ядра ветки 2.2. В ней исправлены некоторые ошибки и обновлен драйвер для контроллеров на AIC7xxx Подробнее: http://www.kernel.org Ядро 2.4.0test2-ac1 Вот и начат процесс по выпуску новых патчей для 2.4.0-test2 от Alana...

Zope < 2.1.7 DocumentTemplate Unauthorized DTML Entity Modification

The remote web server is Zope 2.1.7. There is a security problem in these versions that can allow the contents of DTMLDocuments or DTMLMethods to be changed without forcing proper user authentication. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10447; scriptversion...