Skip to content
OpenAdvisories

Package · PyPI

zope2

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

11 results · Feed

  • Medium 6.1
    CVE-2011-4924

    Zope XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors r…

    zope zope2, zope3 zope zope2 PyPI
  • Medium 6.1
    CVE-2009-5145

    Zope Cross-site scripting (XSS) vulnerability in ZMI pages

    Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.

    zope2 PyPI
  • High 7.5
    CVE-2012-6661

    Plone and Zope2 do not reseed pseudo-random number generator

    Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors. NOTE: this issue was SPLIT from CVE-201…

    plone zope2 PyPI
  • High 7.5
    CVE-2012-5486

    HTTP header injection in Plone and Zope2

    ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

    plone zope2 PyPI
  • Medium 6.5
    CVE-2012-5489

    Plone and Zope2 vulnerable to unauthorized access to restricted attributes

    The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

    plone zope2 PyPI
  • High 7.5
    CVE-2012-5507

    Plone and Zope2 affected by Race Condition

    AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.

    plone zope2 PyPI
  • High —
    CVE-2011-3587 Public exploit EPSS 78%

    Zope Command Execution Vulnerability

    Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.

    zope2 PyPI
  • High —
    CVE-2011-2528

    High severity vulnerability that affects Plone and Zope2

    Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious …

    plone zope2 PyPI
  • Medium —
    CVE-2010-1104

    Moderate severity vulnerability that affects Zope2

    Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messag…

    zope2 PyPI
  • Medium —
    CVE-2006-4684

    Zope allows remote attackers to read arbitrary files

    The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which allows remote attackers to read arbitrary files via a csv_table directive, a different vulnerability …

    zope2 PyPI
  • Low —
    CVE-2006-3458

    Zope allows local users to read arbitrary files

    Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

    zope2 PyPI