Skip to content
Noroxi

zope records

52 published records for vendor zope.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 1.9%
Pre-auth RCE
1
With a fix record
78.8%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 21
  4. 23
  5. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

52 records
  • CVE-2011-3587
    60This week

    Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attacke

    CriticalCVSS 9.3WeaponizedEPSS 78%

    plone · ploneOct 10, 2011

  • CVE-2000-0062
    41Plan

    The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.

    CriticalCVSS 10.0No exploitEPSS 2%

    zope · zopeJan 4, 2000

  • CVE-2024-24811
    39Monitor

    Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

    CriticalCVSS 9.8No exploitEPSS 0%

    zope · sqlalchemydaFeb 7, 2024

  • CVE-2023-37271
    39Monitor

    RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape

    CriticalCVSS 9.9No exploitEPSS 0%

    zope · restrictedpythonJul 11, 2023

  • CVE-2015-7293
    36Monitor

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.

    HighCVSS 8.8Proof of conceptEPSS 3%

    plone · ploneSep 25, 2017

  • CVE-2021-32633
    36Monitor

    Remote Code Execution via traversal in TAL expressions

    HighCVSS 8.8No exploitEPSS 1%

    zope · zopeMay 21, 2021

  • CVE-2021-32674
    35Monitor

    Remote Code Execution via traversal in TAL expressions

    HighCVSS 8.8No exploitEPSS 1%

    zope · zopeJun 8, 2021

  • CVE-2024-47532
    34Monitor

    RestrictedPython information leakage via `AttributeError.obj` and the `string` module

    HighCVSS 8.7No exploitEPSS 0%

    zope · restrictedpythonSep 30, 2024

  • CVE-2024-51734
    34Monitor

    User data deletion by anoynmous users in Zope

    HighCVSS 8.7No exploitEPSS 0%

    zopefoundation · accesscontrolNov 4, 2024

  • CVE-2005-3323
    31Monitor

    docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in Re

    HighCVSS 7.5No exploitEPSS 3%

    zope · zopeOct 27, 2005

  • CVE-2000-0483
    31Monitor

    The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.

    HighCVSS 7.5No exploitEPSS 2%

    zope · zopeJun 15, 2000

  • CVE-2009-0669
    31Monitor

    Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to

    HighCVSS 7.5No exploitEPSS 2%

    zope · zodbAug 7, 2009

  • CVE-2011-2528
    31Monitor

    Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) Plone

    HighCVSS 7.5No exploitEPSS 2%

    plone · plone hotfix 20110720Jul 19, 2011

  • CVE-2021-36089
    31Monitor

    Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecomp

    HighCVSS 7.8No exploitEPSS 1%

    zope · grokJun 30, 2021

  • CVE-2002-0170
    30Monitor

    Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents

    HighCVSS 7.5No exploitEPSS 1%

    zope · zopeApr 22, 2002

  • CVE-2002-0688
    30Monitor

    ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictio

    HighCVSS 7.5No exploitEPSS 1%

    zope · zopeJul 23, 2002

  • CVE-2000-1211
    30Monitor

    Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects

    HighCVSS 7.5No exploitEPSS 1%

    zope · zopeDec 16, 2000

  • CVE-2001-1227
    30Monitor

    Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt at

    HighCVSS 7.5No exploitEPSS 1%

    zope · zopeOct 10, 2001

  • CVE-2001-1278
    30Monitor

    Zope before 2.2.4 allows partially trusted users to bypass security controls for certain methods by accessing the methods through the fmt at

    HighCVSS 7.5No exploitEPSS 1%

    zope · zopeOct 10, 2001

  • CVE-2023-36814
    30Monitor

    zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

    HighCVSS 7.5No exploitEPSS 0%

    zope · products.cmfcoreJul 3, 2023

  • CVE-2023-41039
    30Monitor

    Sandbox escape via various forms of "format" in RestrictedPython

    HighCVSS 7.7No exploitEPSS 0%

    zope · restrictedpythonAug 30, 2023

  • CVE-2023-41050
    30Monitor

    Information disclosure through Python's "format" functionality in Zope AccessControl

    HighCVSS 7.7No exploitEPSS 0%

    zope · accesscontrolSep 6, 2023

  • CVE-2021-32811
    29Monitor

    Remote Code Execution via Script (Python) objects under Python 3

    HighCVSS 7.2No exploitEPSS 2%

    zope · accesscontrolAug 2, 2021

  • CVE-2021-32807
    29Monitor

    Remote Code Execution via unsafe classes in otherwise permitted modules

    HighCVSS 7.2No exploitEPSS 2%

    zope · accesscontrolJul 30, 2021

  • CVE-2000-0725
    28Monitor

    Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by m

    HighCVSS 7.2No exploitEPSS 0%

    zope · zopeOct 20, 2000