zopefoundation

7 results · Clear filters · Feed

• Medium 6.8
  CVE-2026-77401

  Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions

  Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.format_map when those methods are…

  zopefoundation AccessControl accesscontrol PyPI
  Sep 16, 2026
• Medium 6.8
  CVE-2023-41050

  Information disclosure through Python's "format" functionality in Zope AccessControl

  AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those a…

  zopefoundation AccessControl zope accesscontrol PyPI
  Sep 6, 2023
• Medium 4.4
  CVE-2021-32807

  Remote Code Execution via unsafe classes in otherwise permitted modules

  The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined …

  zopefoundation AccessControl zope accesscontrol PyPI
  Jul 30, 2021
• Medium 6.8
  CVE-2021-32633

  Remote Code Execution via traversal in TAL expressions

  Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Pag…

  zopefoundation Zope zope PyPI
  May 21, 2021
• Medium 5.3
  CVE-2021-21360

  Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup

  Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and…

  zopefoundation Products.GenericSetup products-genericsetup PyPI
  Mar 9, 2021
• Medium 5.7
  CVE-2021-21337 Public exploit

  URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

  Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality c…

  zopefoundation Products.PluggableAuthService products-pluggableauthservice PyPI
  Mar 8, 2021
• Medium 6.5
  CVE-2021-21336

  Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager

  Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Rol…

  zopefoundation Products.PluggableAuthService products-pluggableauthservice PyPI
  Mar 8, 2021