THREATIST.IORead the docs No zopefoundation vulnerabilities are listed in CISA KEV.
56 records
Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc…
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment.
SQLAlchemyDA is a generic database adapter for ZSQL methods.
The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.
RestrictedPython is a restricted execution environment for Python to run untrusted code.
Zope AccessControl provides a general security framework for use in Zope.
RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment.
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
Zope is an open-source web application server.
Zope is an open-source web application server.
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF).
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment.
RestrictedPython is a restricted execution environment for Python to run untrusted code.
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework.
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.
The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment.
Zope is an open-source web application server.
Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified…
Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecompress::applyColour).
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications.
ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.
Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt attribute of dtml-var tags.