CVE-2023-33185 Incorrect signature verification in django-ses

Django-SES is a drop-in mail backend for Django. The djangoses library implements a mail backend for Django using AWS Simple Email Service. The library exports the SESEventWebhookView class intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...

CVE-2023-33185 Incorrect signature verification in django-ses

Django-SES is a drop-in mail backend for Django. The djangoses library implements a mail backend for Django using AWS Simple Email Service. The library exports the SESEventWebhookView class intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...

CVE-2023-33185

Django-SES (django_ses) exposes a SESEventWebhookView to verify AWS-signed requests for bounces/subscriptions. The vulnerability was due to a flawed signature verification that allowed specifying arbitrary public certificates. The issue affects django_ses up to version prior to 3.5.0 and was fixe...

Ubuntu: Security Advisory (USN-6054-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Django-SES 数据伪造问题漏洞

Django-SES is the Django email backend for Amazon Simple Email Service. A security vulnerability exists in Django-SES versions prior to 3.5.0 that stems from allowing users to specify arbitrary public certificates...

USN-6054-2: Django vulnerability

USN-6054-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Moataz Al-Sharida and nawaik discovered that Django incorrectly handled uploading multiple files using one form field. A remote attacker...

USN-6054-2 python-django vulnerability

USN-6054-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Moataz Al-Sharida and nawaik discovered that Django incorrectly handled uploading multiple files using one form field. A remote attacker...

Ubuntu 16.04 ESM : Django vulnerability (USN-6054-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6054-2 advisory. USN-6054-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...

NetBox 跨站脚本漏洞

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in NetBox version v3.5.1, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows...

GHSA-QG36-9JXH-FJ25 Incorrect signature verification in django-ses

The djangoses library implements a mail backend for Django using AWS Simple Email Service. The library exports the SESEventWebhookView class intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by djangoses,...

GHSA-X7C2-7WVG-JPX7 kiwitcms vulnerable to stored XSS via unrestricted files upload

Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded, see GHSA-fwcf-753v-fgcj and Content-Security-Policy definition to prevent...

PT-2023-24202 · Unknown · Django-Ses

Name of the Vulnerable Software and Affected Versions: Django-SES versions prior to 3.5.0 Description: The django ses library, a mail backend for Django using AWS Simple Email Service, has a flaw in the verification of signed requests from AWS. The SESEventWebhookView class is intended to handle...

PT-2023-23961

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.3 Description The issue arises from insufficient upload validation checks in Kiwi TCMS, allowing an attacker to upload potentially dangerous files. These files can be combined to circumvent the existing...

Malicious code in print-django (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 078a5d3998b66f598078a8a6af58420b3dc0685a8c48e4e4b4fb7856496c5a24 The OpenSSF Package Analysis project identified 'print-django' @ 3.9.10 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1387 Malicious code in print-django (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 078a5d3998b66f598078a8a6af58420b3dc0685a8c48e4e4b4fb7856496c5a24 The OpenSSF Package Analysis project identified 'print-django' @ 3.9.10 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1362 Malicious code in django-pyyaml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 07b95436e2a145afcd7f459f6101c1d1b699d4d5842126d920fe77f700c8899b The OpenSSF Package Analysis project identified 'django-pyyaml' @ 20.17.15 pypi as malicious. It is considered malicious because: - The package...

Malicious code in django-pyyaml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 07b95436e2a145afcd7f459f6101c1d1b699d4d5842126d920fe77f700c8899b The OpenSSF Package Analysis project identified 'django-pyyaml' @ 20.17.15 pypi as malicious. It is considered malicious because: - The package...

SUSE CVE-2023-31047

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField only the last uploaded file was validated. However,...

OESA-2023-1286 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has...

Mageia: Security Advisory (MGASA-2023-0165)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...