CVSS: 6.4EPSS: 1%CPEs: 99EXPL: 0CVE-2012-5486 – (Plone): Reflexive HTTP header injection
https://notcve.org/view.php?id=CVE-2012-5486
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. ZPublisher.HTTPRequest._scrubHeader en Zope 2 anterior a 2.13.19, utilizado en Plone anterior a 4.3 beta 1, permite a atacantes remotos inyectar cabeceras HTTP arbitrarias a través de un caracter 'linefeed' (LF). It was discovered that Plone, included as a part of luci, did not properly sanitize HTTP headers provided within certain URL requests. • http://rhn.redhat.com/errata/RHSA-2014-1194.html http://www.openwall.com/lists/oss-security/2012/11/10/1 https://bugs.launchpad.net/zope2/+bug/930812 https://plone.org/products/plone-hotfix/releases/20121106 https://plone.org/products/plone/security/advisories/20121106/02 https://access.redhat.com/security/cve/CVE-2012-5486 https://bugzilla.redhat.com/show_bug.cgi?id=878939 • CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •
CVSS: 4.3EPSS: 2%CPEs: 27EXPL: 1CVE-2010-3198
https://notcve.org/view.php?id=CVE-2010-3198
ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that trigger uncaught exceptions. ZServer de Zope v2.10.x anterior a v2.10.12 y v2.11x anterior a v2.11.7 permite a atacantes remotos provocar una denegación de servicio (caída de los procesos activos) a través de vectores que provoquen excepciones no controladas. • http://www.securityfocus.com/bid/42939 http://www.vupen.com/english/advisories/2010/2275 http://www.zope.org/Products/Zope/2.10.12/CHANGES.txt http://www.zope.org/Products/Zope/2.11.7/CHANGES.txt https://bugs.launchpad.net/zope2/+bug/627988 https://mail.zope.org/pipermail/zope-announce/2010-September/002247.html •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2010-1104 – zope: XSS on error page
https://notcve.org/view.php?id=CVE-2010-1104
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en Zope v2.8.x antes de v2.8.12, v2.9.x antes de v2.9.12, v2.10.x antes de v2.10.11, v2.11.x antes de v2.11.6 y v2.12.x antes de v2.12.3 permite a atacantes remotos inyectar HTML o scripts web a través de vectores relacionados con los mensajes de error. • http://secunia.com/advisories/38007 http://www.osvdb.org/61655 http://www.securityfocus.com/bid/37765 http://www.vupen.com/english/advisories/2010/0104 https://exchange.xforce.ibmcloud.com/vulnerabilities/55599 https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html https://access.redhat.com/security/cve/CVE-2010-1104 https://bugzilla.redhat.com/show_bug.cgi?id=577019 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 3%CPEs: 162EXPL: 1CVE-2008-5102 – Zope 2.11.2 - PythonScript Multiple Remote Denial of Service Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-5102
PythonScripts in Zope 2 2.11.2 and earlier, as used in Conga and other products, allows remote authenticated users to cause a denial of service (resource consumption or application halt) via certain (1) raise or (2) import statements. PythonScripts en Zope 2 2.11.2 y anteriores, como se usa en Conga y otros productos, permite a usuarios remotamente autentificados provocar una denegación de servicio (agotamiento de recursos o parada de aplicación) mediante ciertas sentencias (1) raise o (2) import. • https://www.exploit-db.com/exploits/32581 http://bugs.gentoo.org/show_bug.cgi?id=246411 http://mail.zope.org/pipermail/zope/2008-August/174025.html http://openwall.com/lists/oss-security/2008/11/12/2 http://www.vupen.com/english/advisories/2008/2418 http://www.zope.org/Products/Zope/Hotfix-2008-08-12/Hotfix_20080812-1.1.0.tar.gz http://www.zope.org/Products/Zope/Hotfix-2008-08-12/README.txt https://bugs.launchpad.net/zope2/+bug/257269 https://bugs • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-0240
https://notcve.org/view.php?id=CVE-2007-0240
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Zope 2.10.2 y versiones anteriores permite a atacantes remotos inyectar scripts web o HTML de su elección mediante vectores sin especificar en una petición HTTP GET. • http://lists.suse.com/archive/suse-security-announce/2007-May/0005.html http://secunia.com/advisories/24017 http://secunia.com/advisories/24713 http://secunia.com/advisories/25239 http://www.debian.org/security/2007/dsa-1275 http://www.securityfocus.com/bid/23084 http://www.vupen.com/english/advisories/2007/1041 http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view https://exchange.xforce.ibmcloud.com/vulnerabilities/33187 •