Cross-Site Scripting (XSS)

djangocmsattributesfield is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper neutralization of input during web page generation in django CMS Attributes Fields, which allows stored XSS."...

python310-Django4-4.2.17-1.1 on GA media (moderate)

python310-Django4-4.2.17-1.1 on GA media Announcement ID: openSUSE-SU-2024:14565-1 Rating: moderate Cross-References: CVE-2024-53907 CVE-2024-53908 CVSS scores: CVE-2024-53907 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-53908 SUSE : 9.1...

OPENSUSE-SU-2024:14565-1 python310-Django4-4.2.17-1.1 on GA media

These are all security issues fixed in the python310-Django4-4.2.17-1.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of the django.db.models.fields.json class in the Django web application framework allows an attacker to execute arbitrary SQL code.

The vulnerability of the django.db.models.fields.json HasKey software platform for Django web applications is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary SQL code by sending a...

Django 4.x < 4.2.17, 5.0.x < 5.0.10, 5.1.x < 5.1.4 Multiple Vulnerabilities - Linux

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

Django 4.x < 4.2.17, 5.0.x < 5.0.10, 5.1.x < 5.1.4 Multiple Vulnerabilities - Windows

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

python310-django-ckeditor-6.7.2-1.1 on GA media (moderate)

python310-django-ckeditor-6.7.2-1.1 on GA media Announcement ID: openSUSE-SU-2024:14557-1 Rating: moderate Cross-References: CVE-2024-24815 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

Django SQL injection in HasKey(lhs, rhs) on Oracle

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

GHSA-8498-2H75-472J vulnerabilities

Vulnerabilities for packages: py3-django...

GHSA-8498-2H75-472J vulnerabilities

Vulnerabilities for packages: awx, py3-django...

Django denial-of-service in django.utils.html.strip_tags()

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The striptags method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities...

GHSA-M9G8-FXXM-XG86 vulnerabilities

Vulnerabilities for packages: py3-django...

GHSA-M9G8-FXXM-XG86 vulnerabilities

Vulnerabilities for packages: awx, py3-django...

GHSA-M9G8-FXXM-XG86 Django SQL injection in HasKey(lhs, rhs) on Oracle

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

CVE-2024-53908

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

DEBIAN-CVE-2024-53908

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

CVE-2024-53908 vulnerabilities

Vulnerabilities for packages: py3-django...

PYSEC-2024-157

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

CVE-2024-53908 vulnerabilities

Vulnerabilities for packages: awx, py3-django...

PYSEC-2024-157

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...