USN-4975-1 python-django vulnerabilities

It was discovered that the Django URLValidator function incorrectly handled newlines and tabs. A remote attacker could possibly use this issue to perform a header injection attack. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. CVE-2021-32052 Rasmus Lerchedahl Petersen...

UBUNTU-CVE-2021-33571

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. validateipv4address and...

UBUNTU-CVE-2021-33203

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...

CVE-2021-33203

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...

Django 路径遍历漏洞

Django is the Django Foundation's set of open source web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, etc. Django has a path traversal vulnerability that stems from the fact that a user can use the:...

Django 代码问题漏洞

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. Django suffers from a code issue vulnerability that stems from the authenticator accepting leadin...

Ubuntu 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-4975-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4975-1 advisory. It was discovered that the Django URLValidator function incorrectly handled newlines and tabs. A remote attacker could possibly use this issu...

PT-2021-4521

Name of the Vulnerable Software and Affected Versions Django versions 2.2 before 2.2.24 Django versions 3.x before 3.1.12 Django versions 3.2 before 3.2.4 Description The issue is related to the URLValidator, validate ipv4 address, and validate ipv46 address functions in Django, which do not...

PT-2021-4574

Name of the Vulnerable Software and Affected Versions Django versions 2.2.23 and earlier, 3.x versions prior to 3.1.12, 3.2.x versions prior to 3.2.4 Description The issue is related to a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView vi...

openSUSE Security Update : python-django-registration (openSUSE-2021-588)

This update for python-django-registration fixes the following issues : Update to 3.1.2 boo1184427, CVE-2021-21416 - Filter sensitive POST parameters in error reports - Fix RemovedInDjango40Warning from Signal arguments %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

USN-4932-2 python-django vulnerability

USN-4932-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwri...

USN-4932-2: Django vulnerability

USN-4932-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwri...

in cythron/tweango

✍️ Description The Django secret key was hard coded in the Github repository which is vulnerable as https://huntr.dev/bounties/1-other-cythron/Tweango/ accordingly. Since the GitHub public API monitor every single git commit that is made, attacker can still find the key from commit lists. = It is...

Fedora: Security Advisory for python-django (FEDORA-2021-01044b8a59)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Ubuntu 16.04 ESM : Django vulnerability (USN-4932-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4932-2 advisory. USN-4932-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...

in cythron/tweango

✍️ Description Django secret key is pushed into Github repository. This is used to sign Json objects, create hashes and generate Csrf tokens. 🕵️‍♂️ Proof of Concept https://stackoverflow.com/questions/15170637/effects-of-changing-djangos-secret-key/15383766?noredirect=1comment2174349415383766 💥...

[SECURITY] Fedora 34 Update: python-django-3.1.9-1.fc34

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

HTTP Response Header Injection

django is vulnerable to HTTP response header injection. The vulnerability exists when the library does not prevent the use of malicious characters such as newlines and tabs in URL when it is used with Python 3.9.5+...

Django 2.2 < 2.2.21, 3.1 < 3.1.9, 3.2 < 3.2.1 Directory Traversal Vulnerability - Windows

Django is prone to a directory traversal vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

Django 2.2 < 2.2.21, 3.1 < 3.1.9, 3.2 < 3.2.1 Directory Traversal Vulnerability - Linux

Django is prone to a directory traversal vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...