OSVDB: Open Sourced Vulnerability Database

Browse Database

Browsing Vulnerabilities Alphabetically

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9 @

« Previous 1 2 … 18 19 20 21 22 23 24 25 26 27 Next »

OSVDB ID	Disclosure Date	Title
10322 [CLOSE] OSVDB ID : 10322 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope DTMLMethods Proxy Rights Traversal
1514 [CLOSE] OSVDB ID : 1514 - Disclosed: 2000-08-16 Description: (Description Provided by CVE) : Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.	2000-08-16	Zope getRoles Method Arbitrary Role Modification
6283 [CLOSE] OSVDB ID : 6283 - Disclosed: 2000-12-12 Description: Zope contains a flaw that may allow a malicious user to bypass data protection. The issue is triggered due to insecure data updating methods on Image and File objects. It is possible that the flaw may allow a malicious user with DTML editing privileges to modify the raw data of these objects, resulting in a loss of integrity.	2000-12-12	Zope Image and File Update Data Protection Bypass
3449 [CLOSE] OSVDB ID : 3449 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope Iterations Object Access Check Bypass
67293 [CLOSE] OSVDB ID : 67293 - Disclosed: 2010-08-20 Description: (Description Provided by CVE) : The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges.	2010-08-20	Zope LDAPUserFolder Product Products/LDAPUserFolder/LDAPUserFolder.py authenticate() Function Authentication Bypass
6282 [CLOSE] OSVDB ID : 6282 - Disclosed: 2000-12-08 Description: Zope contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when use of Legacy object names ( e.g. DTML Methods )occurs. This flaw may lead to a loss of Confidentiality and/or Integrity.	2000-12-08	Zope Legacy Name Authorization Bypass
6284 [CLOSE] OSVDB ID : 6284 - Disclosed: 2000-12-15 Description: Zope contains a flaw that may allow a malicious user to gain access to unauthorized privileges. In some situations the computation was not climbing the correct hierarchy of folders, granting local roles inappropriately. Exploitation of this issue could grant a local user with privileges in one folder the same privileges specified in another folder. This flaw may lead to a loss of confidentiality and integrity.	2000-12-15	Zope Local Role Computation Error Privilege Escalation
58285 [CLOSE] OSVDB ID : 58285 - Disclosed: 2002-09-26 Description: Unknown / Incomplete	2002-09-26	Zope Malformed XML RPC Request Path Disclosure
10315 [CLOSE] OSVDB ID : 10315 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope Multiple Bound Variable Arbitrary Object Access
10314 [CLOSE] OSVDB ID : 10314 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope Multiple built-in Unspecified Security Check Bypass
10312 [CLOSE] OSVDB ID : 10312 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope Multiple Instance Methods get Request Object Access Restriction Bypass
56827 [CLOSE] OSVDB ID : 56827 - Disclosed: 2009-08-06 Description: (Description Provided by CVE) : Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.	2009-08-06	Zope Object Database (ZODB) ZEO Storage Server Unspecified Arbitrary Python Code Execution
56826 [CLOSE] OSVDB ID : 56826 - Disclosed: 2009-08-06 Description: (Description Provided by CVE) : Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.	2009-08-06	Zope Object Database (ZODB) ZEO Storage Server Unspecified Authentication Bypass
68608 [CLOSE] OSVDB ID : 68608 - Disclosed: 2010-10-08 Description: Zope Object Database contains a race condition in the 'ZEO/StorageServer.py' script that may allow a remote denial of service. The issue is triggered when a remote attacker establishes and then immediately closes a TCP connection, and will result in loss of availability for the program.	2010-10-08	Zope Object Database (ZODB) ZEO/StorageServer.py Multiple Client Connection Remote DoS
57760 [CLOSE] OSVDB ID : 57760 - Disclosed: 2009-09-01 Description: (Description Provided by CVE) : Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.	2009-09-01	Zope Object Database (ZODB) Zope Enterprise Objects (ZEO) Server Arbitrary File Manipulation
73252 [CLOSE] OSVDB ID : 73252 - Disclosed: 2011-05-29 Description: Unknown / Incomplete	2011-05-29	Zope PluggableAuthService (PAS) ZODBUserManager.py updateUser() Method User Login Name Change Duplication
10324 [CLOSE] OSVDB ID : 10324 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope PropertyManager Multiple Types Arbitrary List Modification
5350 [CLOSE] OSVDB ID : 5350 - Disclosed: 2002-03-01 Description: Zope contains a flaw that may allow a malicious user to gain access to files outside the configured security context. The issue is due to Zope failing to honour the security context of the creator of a proxy role when determining access to an object via that role. This flaw may lead to a loss of confidentiality.	2002-03-01	Zope Proxy Role Privilege Escalation
10313 [CLOSE] OSVDB ID : 10313 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope Python Script import as Feature Seceurity Check Bypass
10318 [CLOSE] OSVDB ID : 10318 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope PythonScript Class Arbitrary Variable Access
76105 [CLOSE] OSVDB ID : 76105 - Disclosed: 2011-09-29 Description: (Description Provided by CVE) : Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.	2011-09-29	Zope Request Parsing Unspecified Remote Command Execution
10317 [CLOSE] OSVDB ID : 10317 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope RESPONSE.write() Function Unicode Character DoS
61655 [CLOSE] OSVDB ID : 61655 - Disclosed: 2010-01-12 Description: (Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.	2010-01-12	Zope standard_error_message Template XSS
5166 [CLOSE] OSVDB ID : 5166 - Disclosed: 2004-04-08 Description: Zope contains a flaw that may allow a remote denial of service. The issue can be triggered on systems where users can write "Through The Web Code", and will result in loss of availability for the service.	2004-04-08	Zope Through The Web Code Header Injection DoS
10316 [CLOSE] OSVDB ID : 10316 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope Unpacking Function Arbitrary Object Access
73726 [CLOSE] OSVDB ID : 73726 - Disclosed: 2011-06-28 Description: (Description Provided by CVE) : Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.	2011-06-28	Zope Unspecified Access Restriction Bypass
34366 [CLOSE] OSVDB ID : 34366 - Disclosed: 2007-03-20 Description: (Description Provided by CVE) : Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.	2007-03-20	Zope Unspecified HTTP GET Request CSRF
76645 [CLOSE] OSVDB ID : 76645 - Disclosed: 2011-10-24 Description: Unknown / Incomplete	2011-10-24	Zope Unspecified Remote Issue
19951 [CLOSE] OSVDB ID : 19951 - Disclosed: 2005-10-09 Description: (Description Provided by CVE) : docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in RestructuredText functionality.	2005-10-09	Zope Unspecified RestructuredText Functionality Disclosure
10319 [CLOSE] OSVDB ID : 10319 - Disclosed: 2004-01-08 Description: Unknown / Incomplete	2004-01-08	Zope XML-RPC Instance Marshalling Protected Value Disclosure

« Previous 1 2 … 18 19 20 21 22 23 24 25 26 27 Next »

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.