PT-2015-1974

Name of the Vulnerable Software and Affected Versions Django versions 1.4.x through 1.4.21 Django versions 1.7.x through 1.7.9 Django versions 1.8.x through 1.8.3 Description The issue is related to a resource management error in the contrib.sessions.middleware.SessionMiddleware component of the...

CVE-2015-5145

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

Design/Logic Flaw

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

PYSEC-2015-21

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

CVE-2015-5145

validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service CPU consumption via unspecified vectors...

CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

Fedora 22 : batik-1.8-0.18.svn1230816.fc22 (2015-8803)

Security fix for CVE-2015-0250 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

PYSEC-2015-19

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

Design/Logic Flaw

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

CVE-2015-3982

CVE-2015-3982 affects Django (1.8.x) with the session flush in the cached_db backend: flushing the session can set an empty string as the session key, allowing remote attackers to hijack user sessions. The vulnerability is fixed starting with Django 1.8.2 and related security updates. Affected co...

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the logsurfer+ package up to version 1.8 of the Gentoo Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

Debian DLA-202-1 : wesnoth-1.8 security update

Ignacio R. Morelle discovered that missing path restrictions in the 'Battle of Wesnoth' game could result in the disclosure of arbitrary files in the user's home directory if malicious campaigns/maps are loaded. For the oldstable distribution distribution, this problem has been fixed in version...

[SECURITY] [DLA 202-1] wesnoth-1.8 security update

Package : wesnoth-1.8 Version : 1:1.8.5-1+deb6u1 CVE ID : CVE-2015-0844 Ignacio R. Morelle discovered that missing path restrictions in the "Battle of Wesnoth" game could result in the disclosure of arbitrary files in the users home directory if malicious campaigns/maps are loaded. For the...

Mandriva Linux Security Advisory : python-django (MDVSA-2015:109)

Updated python-django packages fix security vulnerabilities : Jedediah Smith discovered that Django incorrectly handled underscores in WSGI headers. A remote attacker could possibly use this issue to spoof headers in certain environments CVE-2015-0219. Mikko Ohtamaa discovered that Django...

CVE-2015-2317

CVE-2015-2317 affects Django’s utils.http.is_safe_url, where URL validation is insufficient in Django versions prior to 1.4.20, 1.5.x, 1.6.x prior to 1.6.11, 1.7.x prior to 1.7.7, and 1.8.x prior to 1.8c1. This enables remote attackers to perform cross-site scripting via a control character in a ...

UBUNTU-CVE-2015-0250

XML external entity XXE vulnerability in the SVG to 1 PNG and 2 JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file...

Django Cross-Site Scripting Vulnerability (CNVD-2015-01672)

Django is Django Software Foundation of an open source Web application framework using the Python language . The framework includes an object-oriented mapper, view system, template system and so on. A cross-site scripting vulnerability exists in the 'contents' function in the admin/helpers.py fil...