Linux Distros Unpatched Vulnerability : CVE-2009-5145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in ZMI pages that use the managetabsmessage in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10....

Linux Distros Unpatched Vulnerability : CVE-2010-1104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3...

Improper Privilege Management

Zope and AccessControl is vulnerable to Improper Privilege Management. The vulnerability is due to anonymous users being able to delete user data in AccessControl.userfolder.UserFolder, potentially preventing privileged access. Users unable to upgrade can mitigate by adding dataroles = to...

CVE-2024-51734

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...

CVE-2024-51734 User data deletion by anoynmous users in Zope

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...

CVE-2024-51734 User data deletion by anoynmous users in Zope

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...

CVE-2024-51734

CVE-2024-51734 affects Zope AccessControl prior to version 7.2, where anonymous users can delete data in AccessControl.userfolder.UserFolder, potentially disrupting privileged access. The issue is fixed in 7.2; a workaround is to set data__roles__ = () on the UserFolder. No exploitation details a...

CVE-2024-51734 User data deletion by anoynmous users in Zope

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...

Zope AccessControl 访问控制错误漏洞

Zope AccessControl is the common security framework used in Zope from the Zope Foundation. An access control error vulnerability exists in Zope AccessControl versions prior to 7.2, which stems from an attacker being able to delete user data maintained by AccessControl.userfolder.UserFolder, which...

RestrictedPython 信息泄露漏洞

RestrictedPython is a Zope open source tool that helps define a subset of the Python language that allows program input to be provided to a trusted environment. An information disclosure vulnerability exists in RestrictedPython versions prior to 7.3. An attacker exploiting this vulnerability coul...

(0Day) Zope CMFCore Uncontrolled Resource Consumption Denial-of-Service Vulnerability

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Zope Application Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the contentFilter class. The issue results from...

RHEL 5 : luci (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - plone: Header injection CVE-2015-7318 - Cross-site scripting XSS vulnerability in ZMI pages that use the...

Zope 5.9 Command Injection Vulnerability

Vulnerability Report Title: Command Argument Injection Vulnerability in Zope WSGI Instance Creation Script Leading to RCE Description: A command Argument injection vulnerability has been identified in the Zope WSGI instance creation script used by the Zope web application server framework, which ...

Zope 5.9 Command Injection

Vulnerability Report Title: Command Argument Injection Vulnerability in Zope WSGI Instance Creation Script Leading to RCE Description: A command Argument injection vulnerability has been identified in the Zope WSGI instance creation script used by the Zope web application server framework, which ...

Remote Code Execution (RCE)

zodb3 is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of certain Zope Enterprise Objects ZEO database sharing, allowing remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol...

Authentication Bypass

Zope Object Database ZODB Authentication Bypass. The vulnerability is due to certain configurations of Zope Enterprise Objects ZEO database sharing, which can be exploited by remote attackers via vectors involving the ZEO network protocol...

Denial Of Service (DoS)

Zope Object Database ZODB is vulnerable to Denial Of Service DoS. The vulnerability is due to a flaw that allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, resulting in unexpected return values for the accept function...

Plone Security Vulnerability

Plone is an open source content management system CMS built on the Zope application server. A security vulnerability exists in Plone version 5.2.13 that stems from allowing remote code execution...

Cross-Site Scripting (XSS)

Zope is vulnerable to Cross-site Scripting XSS . The vulnerability is due to improper user-input sanitization in the title property. This can allow an attacker to store script code that is executed while viewing the affected object in the Zope Management Interface ZMI...

Zope XSS Vulnerability (GHSA-m755-gxxg-r5qh)

Zope is prone to a cross-site scripting XSS vulnerability via the title property in the Zope management interface. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...