CVE-2024-47532 | Medium | 6.5 | 2024-09-30 | RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) informa… |
CVE-2024-24811 | Critical | 9.8 | 2024-02-07 | SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL s… |
CVE-2023-44389 | Low | 3.1 | 2023-10-04 | Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while view… |
CVE-2023-42458 | Low | 3.7 | 2023-09-21 | Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note th… |
CVE-2023-41050 | Medium | 6.8 | 2023-09-06 | AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" obj… |
CVE-2023-41039 | High | 8.3 | 2023-08-30 | RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format… |
CVE-2023-37271 | High | 8.4 | 2023-07-11 | RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. Restr… |
CVE-2023-36814 | High | 7.5 | 2023-07-03 | Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input i… |
CVE-2021-32811 | High | 7.5 | 2021-08-02 | Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affect… |
CVE-2021-32807 | Medium | 4.4 | 2021-07-30 | The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides… |
CVE-2021-36089 | High | 7.8 | 2021-07-01 | Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecompress::applyColour). |
CVE-2021-32674 | High | 8.8 | 2021-06-08 | Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5… |
CVE-2021-33507 | Medium | 6.1 | 2021-05-21 | Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS. |
CVE-2021-32633 | Medium | 6.8 | 2021-05-21 | Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that… |
CVE-2021-21360 | Medium | 5.3 | 2021-03-09 | Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before… |
CVE-2021-21337 | Medium | 5.7 | 2021-03-08 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an… |
CVE-2021-21336 | Medium | 6.5 | 2021-03-08 | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an… |
CVE-2011-4924 | Medium | 6.1 | 2019-11-25 | Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12… |
CVE-2015-7293 | High | 8.8 | 2017-09-25 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. |
CVE-2009-5145 | Medium | 6.1 | 2017-08-07 | Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2… |
CVE-2012-6661 | | | 2014-11-03 | Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for… |
CVE-2012-5507 | | | 2014-09-30 | AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vect… |
CVE-2012-5489 | | | 2014-09-30 | The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1… |
CVE-2012-5486 | | | 2014-09-30 | ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via… |
CVE-2011-3587 | | | 2011-10-10 | Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbit… |
CVE-2011-2528 | | | 2011-07-19 | Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for… |
CVE-2010-3495 | | | 2010-10-19 | Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by est… |
CVE-2010-3198 | | | 2010-09-08 | ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that… |
CVE-2010-1104 | | | 2010-03-25 | Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12… |
CVE-2009-2701 | | | 2009-09-08 | Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3… |
CVE-2009-0669 | | | 2009-08-07 | Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authenticat… |
CVE-2009-0668 | | | 2009-08-07 | Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote at… |
CVE-2008-5102 | | | 2008-11-17 | PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consu… |
CVE-2007-0240 | | | 2007-03-22 | Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a… |
CVE-2006-4684 | | | 2006-09-19 | The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which a… |
CVE-2006-3458 | | | 2006-07-07 | Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStr… |
CVE-2005-3323 | | | 2005-10-27 | docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText func… |
CVE-2002-0688 | | | 2002-07-23 | ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitra… |
CVE-2002-0687 | | | 2002-07-23 | The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers. |
CVE-2002-0170 | | | 2002-04-22 | Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the… |
CVE-2001-1278 | | | 2001-10-10 | Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var… |
CVE-2001-1227 | | | 2001-10-10 | Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var… |
CVE-2001-0569 | | | 2001-08-22 | Digital Creations Zope 2.3.1 b1 and earlier contains a problem in the method return values related to the classes (1) ObjectManager, (2) PropertyManager, and (… |
CVE-2001-0568 | | | 2001-08-22 | Digital Creations Zope 2.3.1 b1 and earlier allows a local attacker (Zope user) with through-the-web scripting capabilities to alter ZClasses class attributes. |
CVE-2001-0567 | | | 2001-08-14 | Digital Creations Zope 2.3.2 and earlier allows a local attacker to gain additional privileges via the changing of ZClass permission mappings for objects and m… |
CVE-2001-0128 | | | 2001-03-12 | Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges. |
CVE-2000-1212 | | | 2000-12-18 | Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to mod… |
CVE-2000-1211 | | | 2000-12-16 | Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow… |
CVE-2000-0725 | | | 2000-10-20 | Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles… |
CVE-2000-0483 | | | 2000-06-15 | The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization. |
CVE-2000-0062 | | | 2000-01-04 | The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities. |