Zope Cross-site scripting (XSS) vulnerability in ZMI pages

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2009-5145 · ADVISORY
• zopefoundation/Zope commit 2abdf14 · WEB
• bugs.launchpad.net/zope2/+bug/490514 · WEB
• pypa/advisory-database · WEB
• zopefoundation/Zope · PACKAGE
• security-tracker.debian.org/tracker/CVE-2009-5145 · WEB
• cve.killedkenny.io/cve/CVE-2009-5145 · WEB
• openwall.com/lists/oss-security/2015/03/02/7 · WEB
• securityfocus.com/bid/72792/info · Third Party Advisory
• security-tracker.debian.org/tracker/CVE-2009-5145 · Third Party Advisory
• pypi.org/project/zope2 · PACKAGE
• GitHub Advisory GHSA-5r4x-qc7q-vj27 · ADVISORY

zope2 のその他の脆弱性

• CVE-2011-4924中 6.1Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and …
• CVE-2012-6661中 5.0Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which m…
• CVE-2012-5507中 4.3AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain…
• CVE-2012-5489中 6.5The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 an…
• CVE-2012-5486中 6.4ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrar…