Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/zope@4.8.5
Typepypi
Namespace
Namezope
Version4.8.5
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.11.1
Latest_non_vulnerable_version5.11.1
Affected_by_vulnerabilities
0
url VCID-fwdt-q5s4-tud3
vulnerability_id VCID-fwdt-q5s4-tud3
summary Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-51734
reference_id
reference_type
scores
0
value 0.00176
scoring_system epss
scoring_elements 0.39035
published_at 2026-06-12T12:55:00Z
1
value 0.00176
scoring_system epss
scoring_elements 0.3905
published_at 2026-06-14T12:55:00Z
2
value 0.00176
scoring_system epss
scoring_elements 0.39059
published_at 2026-06-13T12:55:00Z
3
value 0.00176
scoring_system epss
scoring_elements 0.38864
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-51734
1
reference_url https://github.com/zopefoundation/AccessControl
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/zopefoundation/AccessControl
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-51734
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-51734
3
reference_url https://github.com/zopefoundation/AccessControl/issues/159
reference_id 159
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
2
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-05T20:05:26Z/
url https://github.com/zopefoundation/AccessControl/issues/159
4
reference_url https://github.com/advisories/GHSA-g5vw-3h65-2q3v
reference_id GHSA-g5vw-3h65-2q3v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g5vw-3h65-2q3v
5
reference_url https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
reference_id GHSA-g5vw-3h65-2q3v
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value 6.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
3
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
4
value MODERATE
scoring_system generic_textual
scoring_elements
5
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-05T20:05:26Z/
url https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
fixed_packages
0
url pkg:pypi/zope@5.11.1
purl pkg:pypi/zope@5.11.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@5.11.1
aliases CVE-2024-51734, GHSA-g5vw-3h65-2q3v
risk_score 4.1
exploitability 0.5
weighted_severity 8.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fwdt-q5s4-tud3
1
url VCID-sruk-c58g-2qgn
vulnerability_id VCID-sruk-c58g-2qgn
summary Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default, only the Manager has this permission.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-42458
reference_id
reference_type
scores
0
value 0.00321
scoring_system epss
scoring_elements 0.55498
published_at 2026-06-11T12:55:00Z
1
value 0.00321
scoring_system epss
scoring_elements 0.5562
published_at 2026-06-14T12:55:00Z
2
value 0.00321
scoring_system epss
scoring_elements 0.55632
published_at 2026-06-13T12:55:00Z
3
value 0.00321
scoring_system epss
scoring_elements 0.55618
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-42458
1
reference_url https://github.com/zopefoundation/Zope
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/zopefoundation/Zope
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-42458
reference_id
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-42458
3
reference_url http://www.openwall.com/lists/oss-security/2023/09/22/2
reference_id 2
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-24T14:48:49Z/
url http://www.openwall.com/lists/oss-security/2023/09/22/2
4
reference_url https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088
reference_id 26a55dbc301db417f47cafda6fe0f983b5690088
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-24T14:48:49Z/
url https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088
5
reference_url https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cb
reference_id 603b0a12881c90a072a7a65e32d47ed898ce37cb
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-24T14:48:49Z/
url https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cb
6
reference_url https://github.com/advisories/GHSA-wm8q-9975-xh5v
reference_id GHSA-wm8q-9975-xh5v
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wm8q-9975-xh5v
7
reference_url https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v
reference_id GHSA-wm8q-9975-xh5v
reference_type
scores
0
value 3.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system cvssv3.1_qr
scoring_elements
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-24T14:48:49Z/
url https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v
fixed_packages
0
url pkg:pypi/zope@4.8.10
purl pkg:pypi/zope@4.8.10
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
1
vulnerability VCID-vms1-cyy1-vqfu
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@4.8.10
1
url pkg:pypi/zope@5.0a1
purl pkg:pypi/zope@5.0a1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
1
vulnerability VCID-zpcq-187m-p3hk
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@5.0a1
2
url pkg:pypi/zope@5.8.5
purl pkg:pypi/zope@5.8.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
1
vulnerability VCID-vms1-cyy1-vqfu
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@5.8.5
aliases CVE-2023-42458, GHSA-wm8q-9975-xh5v
risk_score 1.6
exploitability 0.5
weighted_severity 3.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-sruk-c58g-2qgn
2
url VCID-vms1-cyy1-vqfu
vulnerability_id VCID-vms1-cyy1-vqfu
summary Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-44389
reference_id
reference_type
scores
0
value 0.00372
scoring_system epss
scoring_elements 0.59485
published_at 2026-06-12T12:55:00Z
1
value 0.00372
scoring_system epss
scoring_elements 0.59487
published_at 2026-06-14T12:55:00Z
2
value 0.00372
scoring_system epss
scoring_elements 0.59497
published_at 2026-06-13T12:55:00Z
3
value 0.00372
scoring_system epss
scoring_elements 0.59376
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-44389
1
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2023-193.yaml
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2023-193.yaml
2
reference_url https://github.com/zopefoundation/Zope
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/zopefoundation/Zope
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-44389
reference_id
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-44389
4
reference_url https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
reference_id 21dfa78609ffd8b6bd8143805678ebbacae5141a
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-02T16:01:20Z/
url https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
5
reference_url https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
reference_id aeaf2cdc80dff60815e3706af448f086ddc3b98d
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-02T16:01:20Z/
url https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
6
reference_url https://github.com/advisories/GHSA-m755-gxxg-r5qh
reference_id GHSA-m755-gxxg-r5qh
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m755-gxxg-r5qh
7
reference_url https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
reference_id GHSA-m755-gxxg-r5qh
reference_type
scores
0
value 3.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value LOW
scoring_system cvssv3.1_qr
scoring_elements
3
value LOW
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-02-02T16:01:20Z/
url https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
fixed_packages
0
url pkg:pypi/zope@4.8.11
purl pkg:pypi/zope@4.8.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@4.8.11
1
url pkg:pypi/zope@5.0a1
purl pkg:pypi/zope@5.0a1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
1
vulnerability VCID-zpcq-187m-p3hk
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@5.0a1
2
url pkg:pypi/zope@5.8.6
purl pkg:pypi/zope@5.8.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@5.8.6
aliases CVE-2023-44389, GHSA-m755-gxxg-r5qh, PYSEC-2023-193
risk_score 2.1
exploitability 0.5
weighted_severity 4.3
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vms1-cyy1-vqfu
3
url VCID-w64j-gt6v-mfc7
vulnerability_id VCID-w64j-gt6v-mfc7
summary AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-41050
reference_id
reference_type
scores
0
value 0.00323
scoring_system epss
scoring_elements 0.55877
published_at 2026-06-13T12:55:00Z
1
value 0.00323
scoring_system epss
scoring_elements 0.55863
published_at 2026-06-14T12:55:00Z
2
value 0.00323
scoring_system epss
scoring_elements 0.55862
published_at 2026-06-12T12:55:00Z
3
value 0.00323
scoring_system epss
scoring_elements 0.55742
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-41050
1
reference_url https://github.com/zopefoundation/AccessControl
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/zopefoundation/AccessControl
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-41050
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-41050
3
reference_url https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9
reference_id 6bc32692e0d4b8d5cf64eae3d19de987c7375bc9
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-26T14:47:49Z/
url https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9
4
reference_url https://github.com/advisories/GHSA-8xv7-89vj-q48c
reference_id GHSA-8xv7-89vj-q48c
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8xv7-89vj-q48c
5
reference_url https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c
reference_id GHSA-8xv7-89vj-q48c
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-09-26T14:47:49Z/
url https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c
fixed_packages
0
url pkg:pypi/zope@4.8.9
purl pkg:pypi/zope@4.8.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
1
vulnerability VCID-sruk-c58g-2qgn
2
vulnerability VCID-vms1-cyy1-vqfu
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@4.8.9
1
url pkg:pypi/zope@5.8.4
purl pkg:pypi/zope@5.8.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-fwdt-q5s4-tud3
1
vulnerability VCID-sruk-c58g-2qgn
2
vulnerability VCID-vms1-cyy1-vqfu
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/zope@5.8.4
aliases CVE-2023-41050, GHSA-8xv7-89vj-q48c
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-w64j-gt6v-mfc7
Fixing_vulnerabilities
Risk_score4.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/zope@4.8.5