PT-2022-1408 · Django +6 · Django +6

Name of the Vulnerable Software and Affected Versions: Django versions 2.2 before 2.2.26 Django versions 3.2 before 3.2.11 Django versions 4.0 before 4.0.1 Description: The issue is related to the dictsort template filter in Django, which could potentially lead to information disclosure or an...

Security fix for the ALT Linux 9 package python3-module-django version 2.2.25-alt1

2.2.25-alt1 built Dec. 24, 2021 Alexey Shabalin in task 292358 Dec. 17, 2021 Alexey Shabalin - new version 2.2.25 - Fixes for the following security vulnerabilities: + CVE-2021-44420: Potential bypass of an upstream access control based on URL paths...

Security fix for the ALT Linux 10 package python3-module-django version 3.2.10-alt1

3.2.10-alt1 built Dec. 24, 2021 Anton Farygin in task 292330 Dec. 17, 2021 Alexey Shabalin - new version 3.2.10 - Fixes for the following security vulnerabilities: + CVE-2021-44420 Fixed potential bypass of an upstream access control based on URL paths...

CVE-2021-44420

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths...

MTN Group: Information disclosure through django debug mode

Summary: Your domain https://szezvzorilla.mtn.co.sz was disclosing information throught django debug mode enable. Steps To Reproduce: Visit https://szezvzorilla.mtn.co.sz/NONEXISTINGPATH/ You will the information of debugging Supporting Material/References: F1555934 attachment / reference Impact...

Django -- multiple vulnerabilities

Django Release reports: CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator. CVE-2021-45116: Potential information disclosure in dictsort template filter. CVE-2021-45452: Potential directory-traversal via Storage.save...

Django 2.2 < 2.2.25, 3.1 < 3.1.14, 3.2 < 3.2.10 Access Control Bypass Vulnerability - Linux

Django is prone to an access control bypass vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

Django 2.2 < 2.2.25, 3.1 < 3.1.14, 3.2 < 3.2.10 Access Control Bypass Vulnerability - Windows

Django is prone to an access control bypass vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

MGASA-2021-0552 Updated python-django packages fix security vulnerability

Potential bypass of an upstream access control based on URL paths. CVE-2021-44420 HTTP requests for URLs with trailing newlines could bypass an upstream access control based on URL paths...

Updated python-django packages fix security vulnerability

Potential bypass of an upstream access control based on URL paths. CVE-2021-44420 HTTP requests for URLs with trailing newlines could bypass an upstream access control based on URL paths...

django: Potential directory traversal via ``admindocs``

A flaw was found in django. Staff members could use the :mod:django.contrib.admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been customized by the developers to also expose the file contents, then not...

django: potential directory-traversal via uploaded files

A flaw was found in Django. This flaw allows an attacker to upload specially-named files and exploit a flaw in the MultiPartParser function to traverse directories. The highest threat from this vulnerability is to confidentiality...

django: Potential directory-traversal via archive.extract()

A flaw was found in django where thedjango.utils.archive.extract function, used by startapp --template and startproject --template, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments...

django: Potential directory-traversal via uploaded files

A flaw was found in Django. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names. The highest threat from this vulnerability is to data confidentiality...

django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

A flaw was found in django. Leading zeros in octal literals aren't prohibited in IP addresses. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. The highest threat from this vulnerability is to data integrity...

GHSA-V6RH-HP5X-86RV Potential bypass of an upstream access control based on URL paths in Django

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. This issue has low severity, according to the Django security policy...

Potential bypass of an upstream access control based on URL paths in Django

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. This issue has low severity, according to the Django security policy...

CVE-2021-43410

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 1 of airavata-django-portal 1...

CVE-2021-43410

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 1 of airavata-django-portal 1...

CVE-2021-43410

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 1 of airavata-django-portal 1...