Django: denial-of-service in ``intcomma`` template filter

A vulnerability was found in Django. When used with very long strings, the intcomma template filter was subject to a potential denial of service attack...

python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

An inefficient regular expression complexity flaw was found in the Truncator.words function and truncatewordshtml filter of Django. This issue may allow an attacker to use a suitably crafted string to cause a denial of service...

The vulnerability of the QuerySet.values() and values_list() methods of the Django web application’s JSONField model allows a attacker to execute arbitrary code.

The vulnerability of the QuerySet.values and valueslist methods of the Django web application’s JSONField model is related to the lack of security measures for handling SQL queries. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted SQL query...

OPENSUSE-SU-2024:0251-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-23969: Potential denial-of-service via Accept-Language headers boo1207565 - CVE-2024-38875: Potential denial-of-service attack via certain inputs with a very large number of brackets boo1227590 - CVE-2024-39329: Username...

Security update for python-Django (important)

openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2024:0251-1 Rating: important References: 1207565 1227590 1227593 1227594 1227595 Cross-References: CVE-2023-23969 CVE-2024-38875 CVE-2024-39329 CVE-2024-39330 CVE-2024-39614 CVSS scores: CVE-2023-23969 NVD :...

Vulnerabilities fixed in Microsoft Mariner

Microsoft has fixed vulnerabilities in Mariner Azure Linux. The vulnerabilities concern older vulnerabilities in various subcomponents of the distro, such as Python, Emacs, Qemu, Django, Curl, wget etc. which have been fixed in the new version. Microsoft has made updates available that fix the...

openSUSE 15 Security Update : python-Django (SUSE-SU-2024:2861-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:2861-1 advisory. - Fixed code in CVE-2024-41990 patch Tenable has extracted the preceding description block directly from the SUSE security advisory. Note that Nessus has not...

OESA-2024-1974 python-django security update

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. getsupportedlanguagevariant was subject to a potential denial-of-service attack when used with very...

SUSE-SU-2024:2861-1 Security update for python-Django

This update for python-Django fixes the following issues: - Fixed code in CVE-2024-41990 patch...

Internet Bug Bounty: CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

CVE-2024-42005: Potential SQL injection in QuerySet.values and valueslist A vulnerability was discovered in Django where the QuerySet.values and valueslist methods on models with a JSONField were subject to SQL injection in column aliases via a crafted JSON object key as a passed argument...

Denial Of Service (DoS)

Django is vulnerable to Denial Of Service DoS. The vulnerability is due to inadequate input validation in the floatformat template filter when processing string representations of numbers in scientific notation with large exponents, It allows an attacker to trigger excessive memory consumption,...

Denial Of Service (DoS)

Django is vulnerable to a Denial Of Service DoS. The vulnerability is due to the urlize and urlizetrunc template filters processing very large inputs with a specific sequence of characters...

CVE-2024-41989

A security issue was found in Django. If 'floatformat' received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption. To avoid this, decimals with more than 200 digits are now returned as is. Mitigation Mitigation for th...

Denial Of Service (DoS)

Django is vulnerable to a Denial Of Service DoS. The vulnerability is due to the lack of validation for certain inputs with a very large number of Unicode characters in the urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget. Attackers can create malicious payloads with...

SQL Injection

Django is vulnerable to SQL injection. The vulnerability is due to the QuerySet.values and valueslist functions on models with a JSONField, allowing attackers to manipulate SQL queries in column aliases via a crafted JSON object key passed as an argument...

BIT-DJANGO-2024-41989

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent...

BIT-DJANGO-2024-41990

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters...

BIT-DJANGO-2024-41991

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters...

BIT-DJANGO-2024-42005

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values and valueslist methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg...

SUSE CVE-2024-41989

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent...