7625 matches found
Cross-Site Scripting (XSS)
python-django-horizon is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the groups panel in openstack dashboard...
GLSA-202004-17 : Django: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202004-17 Django: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced below for details. Impact : A remote attacker, by sending specially crafted input,...
Django: Multiple vulnerabilities
Background Django is a Python-based web framework. Description Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by sending specially crafted input, could possibly cause a Denial of Service condition,...
Elemental - An MITRE ATTACK Threat Library
Elemental is a centralized threat library of MITRE ATT&CK techniques, Atomic Red Team tests, and over 280 Sigma rules. It provides an alternative way to explore the ATT&CK dataset, mapping relevant Atomic Red Team tests and Sigma rules to their respective technique. Elemental allows defenders to...
The vulnerability of the `jango.utils.encoding.uri_to_iri` function in the Django web development framework allows a attacker to trigger a denial-of-service attack.
The vulnerability of the jango.utils.encoding.uritoiri function in the Django web development framework is related to incorrect encoding of UTF-8 octal sequences. This can lead to excessive memory usage due to recursion. Exploiting this vulnerability could allow a remote attacker to cause a servi...
The vulnerability of the `django.utils.text.Truncator` class’s `chars()` and `words()` methods in the Django web development framework allows a attacker to cause a denial-of-service attack.
The vulnerability of the django.utils.text.Truncator class’s chars and words methods in the Django web development framework is related to the improper handling of the True value as an argument to html. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
The vulnerability of the HTMLParser module from django.utils.html.strip_tags in the Django web development framework allows a attacker to cause a denial-of-service attack.
The vulnerability of the HTMLParser module in django.utils.html.striptags of the Django web development framework is related to a slow evaluation of large input data, which contain large sequences of incomplete HTML objects. Exploiting this vulnerability may allow an attacker to cause service...
The vulnerability of the Django web application framework, related to a bug in the password restoration mechanism, allows attackers to compromise data integrity.
The vulnerability of the Django web application framework lies in the improper validation of email addresses after converting Unicode characters into registry keys. This allows an attacker to send a reset token. Exploiting this vulnerability could enable a remote attacker to compromise data...
Security fix for the ALT Linux 9 package python3-module-django version 2.2.12-alt1
April 12, 2020 Alexey Shabalin 2.2.12-alt1 - 2.2.12 - Fixes for the following security vulnerabilities: + CVE-2019-19118 Privilege escalation in the Django admin. + CVE-2019-19844 Potential account hijack via password reset form + CVE-2020-7471 Potential SQL injection via StringAggdelimiter +...
Security fix for the ALT Linux 10 package python3-module-django version 2.2.12-alt1
April 12, 2020 Alexey Shabalin 2.2.12-alt1 - 2.2.12 - Fixes for the following security vulnerabilities: + CVE-2019-19118 Privilege escalation in the Django admin. + CVE-2019-19844 Potential account hijack via password reset form + CVE-2020-7471 Potential SQL injection via StringAggdelimiter +...
CVE-2019-12308
A validation flaw was found in Django's AdminURLFieldWidget. The clickable Current URL link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. An unvalidated value stored in the database, or a value provided as a URL query parameter payload, could...
CVE-2018-7536
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions only one regular expression for Django...
CVE-2019-14235
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uritoiri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences...
Django Cross-Site Request Forgery Vulnerability (CNVD-2020-29728)
Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes object-oriented mapper , view system , template system and so on. A cross-site request forgery vulnerability exists in Django 3.0 and earlier versions, no detailed...
CVE-2019-14232
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability i...
Django 3.0 - Cross-Site Request Forgery Token Bypass Exploit
Exploit for php platform in category web applications Exploit Title: Django 3.0 - Cross-Site Request Forgery Token Bypass Exploit Author: Spad Security Group Vendor Homepage: https://www.djangoproject.com/ Software Link: https://pypi.org/project/Django/ Version: 3.0 = Tested on: windows 10...
Django 3.0 Cross Site Request Forgery
Exploit Title: Django 3.0 - Cross-Site Request Forgery Token Bypass Date: 2020-04-08 Exploit Author: Spad Security Group Vendor Homepage: https://www.djangoproject.com/ Software Link: https://pypi.org/project/Django/ Version: 3.0 = Tested on: windows 10 Language: python3.8 t.me/SpadSec Spad...
Django 3.0 - Cross-Site Request Forgery Token Bypass
Exploit Title: Django 3.0 - Cross-Site Request Forgery Token Bypass Date: 2020-04-08 Exploit Author: Spad Security Group Vendor Homepage: https://www.djangoproject.com/ Software Link: https://pypi.org/project/Django/ Version: 3.0 = Tested on: windows 10 Language: python3.8 t.me/SpadSec Spad...
CVE-2019-12781
An HTTP detection flaw was discovered in Django. If deployed behind a reverse-proxy connecting to Django via HTTPS, django.http.HttpRequest.scheme incorrectly detected client requests made using HTTP as using HTTPS. This resulted in incorrect results for issecure and buildabsoluteuri, and HTTP...
Django: the behavior of the underlying HTMLParser leading to DoS
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...