EUVD-2020-0074

Malware in sbrugna...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2025-57833 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2025-57833 Source advisory: OSV:GHSA-6W2R-R2M5-XQ5W...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2025-57833 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2025-57833 Source advisory:...

drf-tus (1.21.1), richie (0.1.0) potentially affected by CVE-2025-57833 via django (1.11.14)

django PYPI version 1.11.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - drf-tus 1.21.1 - richie 0.1.0 Source cves: CVE-2025-57833 Source advisory: OSV:GHSA-6W2R-R2M5-XQ5W...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2025-57833 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2025-57833 Source advisory: OSV:GHSA-6W2R-R2M5-XQ5W...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2025-48432 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2025-48432 Source advisory:...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2024-45231 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2024-45231 Source advisory:...

drf-tus (1.21.1), richie (0.1.0) potentially affected by CVE-2024-45231 via django (1.11.14)

django PYPI version 1.11.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - drf-tus 1.21.1 - richie 0.1.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

drf-tus (1.21.1), richie (0.1.0) potentially affected by CVE-2022-36359 +1 more via django (1.11.14)

django PYPI version 1.11.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - drf-tus 1.21.1 - richie 0.1.0 Source cves: CVE-2022-36359, CVE-2022-45442 Source advisory: OSV:GHSA-8X94-HMJH-97HQ...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2015-0219 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2015-0219 Source advisory: OSV:GHSA-7QFW-J7HP-V45G...

django-pesapal (>=0.3.0, <=0.3.4), django-rulengine (0.0.1) +4 more potentially affected by CVE-2015-5963 via django (>=1.7.0, <=1.7.8)

django PYPI version =1.7.0, =0.3.0, =0.3.4 - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - iepy 0.9.5 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2015-5963 Source advisory: GHSA-PGXH-WFW4-JX2V...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2021-33203 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2021-33203 Source advisory: OSV:GHSA-68W8-QJQ3-2GFM...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2021-33203 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

drf-tus (1.21.1), richie (0.1.0) potentially affected by CVE-2021-33203 via django (1.11.14)

django PYPI version 1.11.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - drf-tus 1.21.1 - richie 0.1.0 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

autogenerated-api (>=1.0.2, <=1.1.12), dj-core-drf (>=0.0.1, <=0.0.8) +11 more potentially affected by CVE-2020-15225 via django-filter (1.0.4)

django-filter PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on django-filter and may be impacted: - autogenerated-api =1.0.2, =0.0.1, =0.7.3, =0.4.10, =0.9.35, =4.0.0, =5.0.0, =1.6.0, =1.3.0, =0.0.6, =0.0.12 Source cves: CVE-2020-1522...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

CVE-2020-10594

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

Design/Logic Flaw

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...

PYSEC-2020-40

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of...