PT-2020-19861

Name of the Vulnerable Software and Affected Versions Plone versions 4.0 through 5.2.1 Description The issue allows users to perform unwanted SQL queries due to SQL Injection in DTML or in connection objects. This problem is related to Zope. Recommendations For Plone versions 4.0 through 5.2.1,...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:086)

A potential security issue exists in versions of Zope up to and including 2.2.4. This issue involves incorrect protection of a data updating method on Image and File objects. Because the method was not correctly protected, it was possible for users with DTML editing privileges to update the raw...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:083)

There is an issue involving security registration of 'legacy' names for certain object constructors such as the constructors for DTML Method Objects. Security was not being applied correctly for the legacy names, making it possible to call those constructors without the permissions that should ha...

Mandrake Linux Security Advisory : Zope (MDKSA-2001:080)

A new Zope hotfix is available that fixes a problem with DTML scripting as described in the README.txt of Hotfix2001-09-28 : 'The issue involves the fmt attribute of dtml-var tags. Without this correction, Zope does not check security access to methods invoked through fmt. This issue could allow...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:043)

The exploit that was not fixed with the previous Zope hotfix involves the getRoles method of user objects contained in the default UserFolder implementation returning a mutable Python type. Because the mutable object is still associated with the persistent User object, users with the ability to...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:035)

A problem exists in the Zope package with the getRoles method of user objects contained in the default UserFolder implementation. Users with the ability to edit DTML could arrange to give themselves extra roles for the duration of a single request by mutating the roles list as a part of the reque...

zope 2.2.4 DTML权限提升漏洞

No description provided by source...

zope 2.2 DTML模板和DTML方法远程修改漏洞

No description provided by source...

Debian Security Advisory DSA 043-1 (zope)

The remote host is missing an update to zope announced via advisory DSA 043-1. OpenVAS Vulnerability Test $Id: deb0431.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 043-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

CVE-2000-1212

CVE-2000-1212 concerns Zope 2.2.0–2.2.4, where a data updating method on Image and File objects is not properly protected. This flaw enables attackers with DTML editing privileges to modify the raw data of these objects. The vulnerability is rooted in insufficient access controls on a data update...

CVE-2000-1212

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects...

CVE-2001-1227: Undefined Security Weakness

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

CVE-2001-1278

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

CVE-2001-1278

Zope vulnerable before 2.2.4: partially trusted users could bypass security checks by invoking methods via the fmt attribute of dtml-var tags. The Mandrake MDKSA-2001:080 hotfix addresses this DTML scripting issue, remedying the fmt access problem and preventing unauthorized method calls. The vul...

CVE-2001-1278: Undefined Security Weakness

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

MDKSA-2001:080 - Zope update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrake Linux Security Update Advisory Package name: Zope Date: October 15th, 2001 Advisory ID: MDKSA-2001:080 Affected versions: 7.1, 7.2, Corporate Server 1.0.1 Problem Description: A new Zope hotfix is available that fixes a problem with DTML...

Moderate: Red Hat Security Advisory: : New Zope packages are available

New Zope packages are available which fix a security flaw with DTML scripting. The updated packages include a "hotfix" product which addresses a security problem with DTML scripting, as described in the Hotfix2001-09-28 README.txt file: "The issue involves the fmt attribute of dtml-var tags...

[SECURITY] [DSA 043-1] New Zope packages available

---------------------------------------------------------------------------- Debian Security Advisory DSA-043-1 [email protected] http://www.debian.org/security/ Martin Schulze March 9, 2001 - ---------------------------------------------------------------------------- Packages : zope...

Zope DTML Role Issue

For those of you that haven't seen it, this is the advisory that came across the zope list regarding the DTML role issue. Begin Advisory Brian Lloyd [email protected] Fri, 8 Dec 2000 15:48:52 -0500 Hi all, Aleksander Salwa has brought a security issue to our attention that affects all Zope...

Zope Image and File Update Data Protection Bypass

According to its banner, the remote web server is Zope 2.2.5. Such versions suffer from a security issue involving incorrect protection of a data updating method on Image and File objects. Because the method is not correctly protected, it is possible for users with DTML editing privileges to upda...