CVSS: 4.3EPSS: 3%CPEs: 28EXPL: 0CVE-2010-3495
https://notcve.org/view.php?id=CVE-2010-3495
Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492. Condición de carrera en ZEO/StorageServer.py en Zope Object Database (ZODB) antes de v3.10.0 permite a atacantes remotos provocar una denegación de servicio (parada programada del demonio) mediante el establecimiento e inmediatamente el cierre de una conexión TCP, lo que lleva a que la función 'accept' tenga un valor de retorno de 'None', un valor inesperado de 'None' para la dirección, o un error ECONNABORTED, EAGAIN o EWOULDBLOCK. Se trata de un problema relacionado con CVE-2010-3492. • http://bugs.python.org/issue6706 http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html http://pypi.python.org/pypi/ZODB3/3.10.0#id1 http://secunia.com/advisories/41755 http://www.openwall.com/lists/oss-security/2010/09/09/6 http://www.openwall.com/lists/oss-security/2010/09/11/2 http://www.openwall.com/lists/oss-security/2010/09/22/3 http://www.openwall.com/lists/oss-security/2010/09/24/3 https://bugs.launchpad.net/zodb/+bug&# • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 17EXPL: 0CVE-2009-0668
https://notcve.org/view.php?id=CVE-2009-0668
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol. Vulnerabilidad no especificada en Zope Object Database (ZODB) anterior a v3.8.2, cuando ciertos Zope Enterprise Objects (ZEO) habilitan compartir base de datos, permite a atacantes remotos ejecutar código Python arbitrario a través de vectores relaccionados con el protocolo de red ZEO. • http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html http://osvdb.org/56827 http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 http://secunia.com/advisories/36204 http://secunia.com/advisories/36205 http://www.securityfocus.com/bid/35987 http://www.vupen.com/english/advisories/2009/2217 https://exchange.xforce.ibmcloud.com/vulnerabilities/52377 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2009-0669
https://notcve.org/view.php?id=CVE-2009-0669
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol. Zope Object Database (ZODB) anterior a v3.8.2, cuando ciertos Zope Enterprise Objects (ZEO) habilitan compartir base de datos, permite a atacantes remotos eludir la autenticación a través de vectores implicados en el protocolo de red ZEO. • http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html http://osvdb.org/56826 http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2 http://secunia.com/advisories/36204 http://secunia.com/advisories/36205 http://www.securityfocus.com/bid/35987 http://www.vupen.com/english/advisories/2009/2217 https://exchange.xforce.ibmcloud.com/vulnerabilities/52379 • CWE-287: Improper Authentication •