Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

zope

18 known vulnerabilities (3 high, 3 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
18 · 3 high, 3 medium, 2 low
Registry
PyPI

Advisories 18

  • User data deletion by anoynmous users in Zope

    Affected: fixed in 5.11.1.

  • Zope management interface vulnerable to stored cross site scripting via the title property

    Affected: from 5.0, fixed in 5.8.6; from 4.0, fixed in 4.8.11; from 4.0.0, fixed in 4.8.11; from 5.0.0, fixed in 5.8.6.

  • Zope vulnerable to Stored Cross Site Scripting with SVG images

    Affected: fixed in 4.8.10; from 5.8.0, fixed in 5.8.5; fixed in 4.8.10; from 5.8.0, fixed in 5.8.5.

  • CVE-2023-41050Medium 6.8

    Information disclosure through Python's "format" functionality in Zope AccessControl

    Affected: fixed in 4.8.9; from 5.0.0, fixed in 5.8.4; fixed in 4.8.9; from 5.0.0, fixed in 5.8.4.

  • Remote Code Execution via Script (Python) objects under Python 3

    Affected: from 4.0, fixed in 4.6.3; from 5.0, fixed in 5.3; from 4.0, fixed in 4.6.3; from 5.0, fixed in 5.3.

  • CVE-2021-32807Medium 4.4

    Remote Code Execution via unsafe classes in otherwise permitted modules

    Affected: from 4.0, fixed in 4.3; from 5.0, fixed in 5.2; from 4.0, fixed in 4.3; from 5.0, fixed in 5.2.

  • Remote Code Execution via traversal in TAL expressions

    Affected: from 4.0, fixed in 4.6.1; from 5.0, fixed in 5.2.1; from 5.0, fixed in 5.2.1; fixed in 4.6.1.

  • CVE-2021-32633Medium 6.8

    Remote Code Execution via traversal in TAL expressions

    Affected: fixed in 4.6; from 5.0, fixed in 5.2; fixed in 4.6; from 5.0, fixed in 5.2.

  • Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6…

    Affected: from 3.1.1, fixed in 3.7.3.

  • ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker…

    Affected: from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.7; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.7.

  • ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access…

    Affected: from 2.4.0, fixed in 2.6.0.

  • The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.

    Affected: from 2.0.0, fixed in 2.4.4b2; from 2.5.0, fixed in 2.5.1b2; from 2.0.0, fixed in 2.4.4b2; from 2.5.0, fixed in 2.5.1b2.

  • Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access…

    Affected: from 2.2.0, fixed in 2.4.4; from 2.5.0, fixed in 2.5.1; from 2.2.0, fixed in 2.4.4; from 2.5.0, fixed in 2.5.1.

  • Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML…

    Affected: from 2.2.0, through 2.2.4.

  • Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method…

    Affected: from 2.2.0, through 2.2.4.

Show all 18 advisoriesShow fewer advisories

  • Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by…

    Affected: fixed in 2.2.1.

  • The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.

    Affected: through 2.2.

  • The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.

    Affected: from 2.2.0, through 2.2.4.