# zope (PyPI) vulnerabilities 18 known vulnerabilities (3 high, 3 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pypi.org/project/zope/ ## Advisories (18) ### [CVE-2024-51734](https://cve.now/CVE-2024-51734): User data deletion by anoynmous users in Zope - Severity: High 8.7 - Published: Nov 4, 2024 - Affected: fixed in 5.11.1. ### [CVE-2023-44389](https://cve.now/CVE-2023-44389): Zope management interface vulnerable to stored cross site scripting via the title property - Severity: Low 3.1 - Published: Oct 4, 2023 - Affected: from 5.0, fixed in 5.8.6; from 4.0, fixed in 4.8.11; from 4.0.0, fixed in 4.8.11; from 5.0.0, fixed in 5.8.6. ### [CVE-2023-42458](https://cve.now/CVE-2023-42458): Zope vulnerable to Stored Cross Site Scripting with SVG images - Severity: Low 3.7 - Published: Sep 21, 2023 - Affected: fixed in 4.8.10; from 5.8.0, fixed in 5.8.5; fixed in 4.8.10; from 5.8.0, fixed in 5.8.5. ### [CVE-2023-41050](https://cve.now/CVE-2023-41050): Information disclosure through Python's "format" functionality in Zope AccessControl - Severity: Medium 6.8 - Published: Sep 6, 2023 - Affected: fixed in 4.8.9; from 5.0.0, fixed in 5.8.4; fixed in 4.8.9; from 5.0.0, fixed in 5.8.4. ### [CVE-2021-32811](https://cve.now/CVE-2021-32811): Remote Code Execution via Script (Python) objects under Python 3 - Severity: High 7.5 - Published: Aug 2, 2021 - Affected: from 4.0, fixed in 4.6.3; from 5.0, fixed in 5.3; from 4.0, fixed in 4.6.3; from 5.0, fixed in 5.3. ### [CVE-2021-32807](https://cve.now/CVE-2021-32807): Remote Code Execution via unsafe classes in otherwise permitted modules - Severity: Medium 4.4 - Published: Jul 30, 2021 - Affected: from 4.0, fixed in 4.3; from 5.0, fixed in 5.2; from 4.0, fixed in 4.3; from 5.0, fixed in 5.2. ### [CVE-2021-32674](https://cve.now/CVE-2021-32674): Remote Code Execution via traversal in TAL expressions - Severity: High 8.8 - Published: Jun 8, 2021 - Affected: from 4.0, fixed in 4.6.1; from 5.0, fixed in 5.2.1; from 5.0, fixed in 5.2.1; fixed in 4.6.1. ### [CVE-2021-32633](https://cve.now/CVE-2021-32633): Remote Code Execution via traversal in TAL expressions - Severity: Medium 6.8 - Published: May 21, 2021 - Affected: fixed in 4.6; from 5.0, fixed in 5.2; fixed in 4.6; from 5.0, fixed in 5.2. ### [CVE-2011-4924](https://cve.now/CVE-2011-4924): Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6… - Severity: Unrated - Published: Nov 25, 2019 - Affected: from 3.1.1, fixed in 3.7.3. ### [CVE-2010-3198](https://cve.now/CVE-2010-3198): ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker… - Severity: Unrated - Published: Sep 8, 2010 - Affected: from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.7; from 2.10.0, fixed in 2.10.12; from 2.11.0, fixed in 2.11.7. ### [CVE-2002-0688](https://cve.now/CVE-2002-0688): ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access… - Severity: Unrated - Published: Apr 2, 2003 - Affected: from 2.4.0, fixed in 2.6.0. ### [CVE-2002-0687](https://cve.now/CVE-2002-0687): The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers. - Severity: Unrated - Published: Apr 2, 2003 - Affected: from 2.0.0, fixed in 2.4.4b2; from 2.5.0, fixed in 2.5.1b2; from 2.0.0, fixed in 2.4.4b2; from 2.5.0, fixed in 2.5.1b2. ### [CVE-2002-0170](https://cve.now/CVE-2002-0170): Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access… - Severity: Unrated - Published: Apr 2, 2003 - Affected: from 2.2.0, fixed in 2.4.4; from 2.5.0, fixed in 2.5.1; from 2.2.0, fixed in 2.4.4; from 2.5.0, fixed in 2.5.1. ### [CVE-2000-1212](https://cve.now/CVE-2000-1212): Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML… - Severity: Unrated - Published: Apr 2, 2003 - Affected: from 2.2.0, through 2.2.4. ### [CVE-2000-1211](https://cve.now/CVE-2000-1211): Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method… - Severity: Unrated - Published: Apr 2, 2003 - Affected: from 2.2.0, through 2.2.4. ### [CVE-2000-0725](https://cve.now/CVE-2000-0725): Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by… - Severity: Unrated - Published: Oct 13, 2000 - Affected: fixed in 2.2.1. ### [CVE-2000-0483](https://cve.now/CVE-2000-0483): The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization. - Severity: Unrated - Published: Oct 13, 2000 - Affected: through 2.2. ### [CVE-2000-0062](https://cve.now/CVE-2000-0062): The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities. - Severity: Unrated - Published: Apr 18, 2000 - Affected: from 2.2.0, through 2.2.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/zope Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.