EUVD-2014-0069

Malware in sbrugna...

Code injection

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator PRNG, which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability...

CVE-2012-5508

CVE-2012-5508 (and related CVE-2012-6661) affects Zope before 2.13.19 used with Plone older than 4.2.3 and Plone 4.3 beta1. Root cause: PRNG not reseeded, enabling remote attackers to infer PRNG state and potentially abuse password resets via unspecified vectors. Mitigation: upgrade to Zope 2.13....