Skip to content
OpenAdvisories

Package · PyPI

zope

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.7
    CVE-2024-51734

    User data deletion by anoynmous users in Zope

    Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed…

    zopefoundation AccessControl zope accesscontrol PyPI
  • High 7.5
    CVE-2021-32811

    Remote Code Execution via Script (Python) objects under Python 3

    Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below …

    zopefoundation Zope zope accesscontrol Ubuntu PyPI
  • High 8.8
    CVE-2021-32674

    Remote Code Execution via traversal in TAL expressions

    Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules…

    zopefoundation Zope zope PyPI
  • High 7.5
    CVE-2010-3198

    Zope Denial of Service (DoS) vulnerability in ZServer

    ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that trigger uncaught exceptions.

    zope PyPI
  • High —
    CVE-2002-0170

    Zope does not properly verify the access for objects with proxy roles

    Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

    zope PyPI
  • High —
    CVE-2002-0688

    ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions

    ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.

    zope PyPI
  • High —
    CVE-2000-1211

    Zope does not properly perform security registration for legacy names

    Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities.

    zope PyPI
  • High —
    CVE-2000-0725

    Zope does not properly restrict access to the getRoles method

    Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

    zope PyPI
  • High —
    CVE-2000-0062

    Zope DTML implementation Improper Authentication

    The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.

    zope PyPI