RHEL 9 : Red Hat OpenStack Platform 17.1 (python-django) (RHSA-2024:0212)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0212 advisory. Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as...

openSUSE 15 Security Update : python-django-grappelli (openSUSE-SU-2024:0017-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0017-1 advisory. - views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith/ but this does not...

Cross-site Scripting (XSS)

Overview github.com/gofiber/template/v2/django/v2 is a template engine create by flosch. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Views interface due to improper input validation. An attacker can execute malicious scripts in users' browsers when visitin...

CVE-2024-22199 Django Template Engine Vulnerable to XSS

This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious...

CVE-2024-22199 Django Template Engine Vulnerable to XSS

This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious...

GHSA-4MQ2-GC4J-CMW6 Django Template Engine Vulnerable to XSS

Impact Vulnerability Type: Cross-Site Scripting XSS Affected Users: All users of the Django template engine for Fiber prior to the patch. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of...

Django Template Engine Vulnerable to XSS

Impact Vulnerability Type: Cross-Site Scripting XSS Affected Users: All users of the Django template engine for Fiber prior to the patch. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of...

OPENSUSE-SU-2024:0017-1 Security update for python-django-grappelli

This update for python-django-grappelli fixes the following issues: Update to 2.14.4: - CVE-2021-46898: Fixed views/switch.py vulnerable to protocol-relative URL attacks boo1216481 - Fixed: Redirect with switch user. - Improved: Remove extra filtering in AutocompleteLookup. - Improved: Added impo...

PT-2024-19268 · Unknown · Django Template Engine

Name of the Vulnerable Software and Affected Versions: Django template engine for Fiber versions prior to the latest patched version Description: This issue specifically impacts web applications that render user-supplied data through the Django template engine, potentially leading to the executio...

Security update for python-django-grappelli (moderate)

openSUSE Security Update: Security update for python-django-grappelli Announcement ID: openSUSE-SU-2024:0017-1 Rating: moderate References: 1216481 Cross-References: CVE-2021-46898 CVSS scores: CVE-2021-46898 NVD : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE...

Django -- multiple vulnerabilities

Django reports: CVE-2024-24680:Potential denial-of-service in intcomma template filter...

The vulnerability of the Django web application software lies in the fact that code is loaded without any checks for its integrity. This allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the Django web application framework lies in the fact that code is loaded without any checks for its integrity. Exploiting this vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause service failures...

The vulnerability of the Django web application framework, related to insufficient processing of regular expressions, allows a hacker to trigger a service failure.

The vulnerability of the Django web application framework is related to insufficient processing of regular expressions. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Django web application platform, related to uncontrolled resource consumption, allows attackers to trigger service failures.

The vulnerability of the Django web application framework is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the django.utils.encoding.uri_to_iri() component in the Django web application framework allows a attacker to cause a denial-of-service attack.

The vulnerability of the django.utils.encoding.irToIri component in the Django web application framework is related to an improper check on the number of data inputs. Exploiting this vulnerability could allow a remote attacker to cause a service failure. source-iocs-preserved...

CVE-2023-51649

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

PYSEC-2023-287

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

Code injection

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

CVE-2023-51649 Nautobot missing object-level permissions enforcement when running Job Buttons

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

CVE-2023-51649

CVE-2023-51649 affects Nautobot, a Django-based network automation platform. The issue: when submitting a Job via a Job Button, only the model-level extras.run_job permission is enforced; object-level permissions (permission to run a specific Job) are not checked by the relevant URL/view. Result:...