CVE-2002-0170

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration...

CVE-2002-0688

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes...

CVE-2002-0688

CVE-2002-0688 applies to the ZCatalog plug-in in Zope (versions 2.4.0–2.5.1). The flaw is a security-settings issue in ZCatalog that allows anonymous users and untrusted code to bypass access restrictions and invoke arbitrary methods of catalog indexes. Impact documented as remote access to catal...

CVE-2002-0687

Zope Server DoS via header injection (CVE-2002-0687) affects Zope versions 2.0 through 2.5.1 beta 1, where the "through the web code" capability allows untrusted users to crash the server by injecting malicious headers into a response. The connected advisories (GHSA-vwrc-g9q6-f675 and OSV) descri...

CVE-2000-1211

The CVE concerns Zope 2.2.0 through 2.2.4, where security registrations for legacy names of object constructors (e.g., DTML method objects) are not performed correctly. This could allow attackers to perform unauthorized activities due to improper access control on constructor names. The issue is ...

CVE-2002-0170

CVE-2002-0170 affects Zope 2.2.0 through 2.5.1. The underlying issue is improper verification of access for objects with proxy roles, which could allow some users to access documents contrary to the intended configuration. Several sources (GHSA/OSV, CVE records, and related advisories) corroborat...

CVE-2002-0687

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers...

CVE-2002-0170: Undefined Security Weakness

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration...

CVE-2002-0687: Undefined Security Weakness

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers...

CVE-2002-0688: Undefined Security Weakness

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes...

Zope Malformed XML RPC Request Path Disclosure

There is a minor security problem in all releases of Zope prior to version 2.5.1b1 - they reveal the installation path when an invalid XML RPC request is sent. C Tenable Network Security, Inc. http://collector.zope.org/Zope/359 include"compat.inc"; ifdescription scriptid11234; scriptversion "1.19...

Zope 2.x - Incorrect XML-RPC Request Information Disclosure

Zope 2.x - Incorrect XML-RPC Request Information Disclosure source: https://www.securityfocus.com/bid/5806/info A vulnerability has been reported for Zope 2.5.1 and earlier. Reportedly, Zope does not handle XML-RPC requests properly. Specially crafted XML-RPC requests may cause Zope to respond to...

Zope 2.x - Incorrect XML-RPC Request Information Disclosure

source: https://www.securityfocus.com/bid/5806/info A vulnerability has been reported for Zope 2.5.1 and earlier. Reportedly, Zope does not handle XML-RPC requests properly. Specially crafted XML-RPC requests may cause Zope to respond to a request with an error page with system specific details...

CVE-2002-0687

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers...

CVE-2002-0688

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes...

PT-2002-1712

Name of the Vulnerable Software and Affected Versions Zope versions 2.0 through 2.5.1 b1 Description The issue allows untrusted users to shut down the Zope server via certain headers, specifically when using the "through the web code" capability. This is caused by a vulnerability that can be...

PT-2002-1713

Name of the Vulnerable Software and Affected Versions Zope versions 2.4.0 through 2.5.1 Description The issue allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes due to the ZCatalog plug-in index support capability. Recommendations...

CVE-2001-1227

CVE-2001-1227 affects Zope up to version prior to 2.2.4. The vulnerability arises when partially trusted users can bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags. Publicly available details in connected advisories confirm the root ...

CVE-2001-1227

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...

CVE-2001-1227: Undefined Security Weakness

Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags...