828 matches found
CVE-2005-3323
docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality...
CVE-2005-3323
CVE-2005-3323 affects docutils in Zope: Zope 2.6, Zope 2.7 before 2.7.8, and Zope 2.8 before 2.8.2 are vulnerable. The flaw allows remote attackers to include arbitrary files via include directives in RestructuredText functionality. Root cause: insecure handling of include directives in docutils ...
CVE-2005-3323: Undefined Security Weakness
docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality...
Zope: File inclusion through RestructuredText
Background Zope is an application server that can be used to build content management systems, intranets, portals or other custom applications. Description Zope honors file inclusion directives in RestructuredText objects by default. Impact An attacker could exploit the vulnerability by sending...
[Full-disclosure] [ GLSA 200510-20 ] Zope: File inclusion through RestructuredText
Gentoo Linux Security Advisory GLSA 200510-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...
[SA17173] Zope Unspecified docutils Security Issue
TITLE: Zope Unspecified docutils Security Issue SECUNIA ADVISORY ID: SA17173 VERIFY ADVISORY: http://secunia.com/advisories/17173/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: From remote SOFTWARE: Zope 2.x http://secunia.com/product/397/ DESCRIPTION: A security issue with an unknown impa...
zope -- expose RestructuredText functionality to untrusted users
A Zope Hotfix Alert reports: This hotfix resolves a security issue with docutils. Affected are possibly all Zope instances that expose RestructuredText functionalies to untrusted users through the web...
Debian DSA-043-1 : zope
This advisory covers several vulnerabilities in Zope that have been addressed.Hotfix 08092000 'Zope security alert and hotfix product' The issue involves the fact that the getRoles method of user objects contained in the default UserFolder implementation returns a mutable Python type. Because the...
Debian DSA-490-1 : zope - arbitrary code execution
A vulnerability has been discovered in the index support of the ZCatalog plug-in in Zope, an open source web application server. A flaw in the security settings of ZCatalog allows anonymous users to call arbitrary methods of catalog indexes. The vulnerability also allows untrusted code to do the...
Debian DSA-055-1 : zope - remote unauthorized access
A new Zope hotfix has been released which fixes a problem in ZClasses. The README for the 2001-05-01 hotfix describes the problem as any user can visit a ZClass declaration and change the ZClass permission mappings for methods and other objects defined within the ZClass, possibly allowing for...
Zope < 2.2.5 Multiple Vulnerabilities
Binary data 1445.prm...
Zope < 2.1.7 DocumentTemplate Unauthorized Modification
Binary data 1444.prm...
Zope < 2.3.3 ZClass Permission Mapping Modification Local Privilege Escalation
Binary data 1446.prm...
[SECURITY] [DSA 490-1] New Zope packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 490-1 [email protected] http://www.debian.org/security/ Martin Schulze April 17th, 2004 http://www.debian.org/security/faq -...
[SECURITY] [DSA 490-1] New Zope packages fix arbitrary code execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 490-1 [email protected] http://www.debian.org/security/ Martin Schulze April 17th, 2004 http://www.debian.org/security/faq -...
Zope < 2.6.3 Multiple Vulnerabilities
The remote web server is a version of Zope which is older than version 2.6.3. There are multiple security issues in all releases prior to version 2.6.3 or 2.7 BETA4 which can be exploited by an attacker to perform cross-site scripting attacks, obtain information about the remote host, or disable...
Zope Invalid Query Path Disclosure
The remote Zope web server may be forced into disclosing its physical path when calling 'Examples/ShoppingCart/addItems' with a blank quantity. Note that this install is also likely to be affected by several other vulnerabilities, although Nessus has not checked for them. C Tenable Network...
CVE-2000-1211
Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities...
CVE-2000-1212
CVE-2000-1212 concerns Zope 2.2.0–2.2.4, where a data updating method on Image and File objects is not properly protected. This flaw enables attackers with DTML editing privileges to modify the raw data of these objects. The vulnerability is rooted in insufficient access controls on a data update...