Skip to content
OpenAdvisories

Package · PyPI

zope

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.8
    CVE-2023-41050

    Information disclosure through Python's "format" functionality in Zope AccessControl

    AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those a…

    zopefoundation AccessControl zope accesscontrol PyPI
  • Medium 4.4
    CVE-2021-32807

    Remote Code Execution via unsafe classes in otherwise permitted modules

    The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined …

    zopefoundation AccessControl zope accesscontrol PyPI
  • Medium 6.8
    CVE-2021-32633

    Remote Code Execution via traversal in TAL expressions

    Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Pag…

    zopefoundation Zope zope PyPI
  • Medium 6.1
    CVE-2011-4924

    Zope XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors r…

    zope zope2, zope3 zope zope2 PyPI
  • Medium —
    CVE-2002-0687

    Zope Server vulnerable to DoS via header injection

    The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.

    zope PyPI
  • Medium —
    CVE-2000-1212

    Zope allows attackers to modify raw image and file data

    Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects.

    zope PyPI
  • Medium —
    CVE-2000-0483

    Zope DocumentTemplate package allows unauthenticated write

    The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.

    zope PyPI