GCVE - cpe:2.3:a:zope:zope:2.11.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:zope:zope:2.11.2:*:*:*:*:*:*:*

part: a version: 2.11.2 update: *

Vendor	Zope (`400d8950-2847-5748-8fcd-7612c2170a9a`)
Product	Zope (`0a3941f2-1c45-5687-af62-1666d59c833f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/zopefoundation/zope`	purl2cpe	2026-06-01 10:18:07.063967
`pkg:pypi/zope`	purl2cpe	2026-06-01 10:18:07.063969
`pkg:sourceforge/zope`	purl2cpe	2026-06-01 10:18:07.063970

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-5507`	vulnerable	2026-06-08 05:02:56.815744	Details available AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation. Published: 2014-09-30T14:00:00.000Z Updated: 2024-08-06T21:05:47.261Z Open on db.gcve.eu Reference links https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt https://bugs.launchpad.net/zope2/+bug/1071067 http://www.openwall.com/lists/oss-security/2012/11/10/1 https://plone.org/products/plone-hotfix/releases/20121106 https://plone.org/products/plone/security/advisories/20121106/23	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5489`	vulnerable	2026-06-08 05:02:56.775887	Details available The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors. Published: 2014-09-30T14:00:00.000Z Updated: 2024-08-06T21:05:47.309Z Open on db.gcve.eu Reference links https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt http://www.openwall.com/lists/oss-security/2012/11/10/1 https://plone.org/products/plone/security/advisories/20121106/05 https://bugs.launchpad.net/zope2/+bug/1079238 https://plone.org/products/plone-hotfix/releases/20121106	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5486`	vulnerable	2026-06-08 05:02:56.749499	Details available ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. Published: 2014-09-30T14:00:00.000Z Updated: 2024-08-06T21:05:47.236Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/zope2/+bug/930812 https://plone.org/products/plone/security/advisories/20121106/02 http://www.openwall.com/lists/oss-security/2012/11/10/1 https://plone.org/products/plone-hotfix/releases/20121106 http://rhn.redhat.com/errata/RHSA-2014-1194.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3198`	vulnerable	2026-06-08 04:55:13.572425	Details available ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that trigger uncaught exceptions. Published: 2010-09-08T19:00:00.000Z Updated: 2024-09-16T16:22:53.404Z Open on db.gcve.eu Reference links http://www.zope.org/Products/Zope/2.10.12/CHANGES.txt http://www.vupen.com/english/advisories/2010/2275 https://mail.zope.org/pipermail/zope-announce/2010-September/002247.html http://www.zope.org/Products/Zope/2.11.7/CHANGES.txt http://www.securityfocus.com/bid/42939	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-1104`	vulnerable	2026-06-08 04:54:05.214099	Details available Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages. Published: 2010-03-25T17:00:00.000Z Updated: 2024-08-07T01:14:06.107Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2010/0104 http://www.securityfocus.com/bid/37765 http://www.osvdb.org/61655 https://exchange.xforce.ibmcloud.com/vulnerabilities/55599 https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-5145`	vulnerable	2026-06-08 04:51:52.173049	Details available Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12. Published: 2017-08-07T17:00:00.000Z Updated: 2024-08-07T07:32:22.382Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/zope2/+bug/490514 http://www.securityfocus.com/bid/72792/info http://www.openwall.com/lists/oss-security/2015/03/02/7 http://cve.killedkenny.io/cve/CVE-2009-5145 https://github.com/zopefoundation/Zope/commit/2abdf14620f146857dc8e3ffd2b6a754884c331d	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.