CVE-2020-9402

CVE-2020-9402 affects Django: SQL injection via a tolerance parameter in GIS functions/aggregates when using Oracle. Affected versions are Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4. The root cause is improper escaping allowing crafted tolerance to inject SQL. Remediation...

CVE-2020-9402

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escapi...

SQL Injection

django is vulnerable to SQL injection. Lack of adequate validation and sanitization of the tolerance parameter allows an attacker to inject and execute arbitrary SQL statements in the database...

Ubuntu: Security Advisory (USN-4296-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-9402

A SQL-injection flaw was found in python-django, where GIS functions and aggregates in Oracle did not correctly neutralize tolerance-parameter data. A remote attacker could use this flaw to submit crafted data to inject malicious SQL. Mitigation There is no known mitigation for this issue, the fl...

USN-4296-1 python-django vulnerability

Norbert Szetei discovered that Django incorrectly handled the GIS functions and aggregates on Oracle. A remote attacker could possibly use this issue to perform an SQL injection attack...

USN-4296-1: Django vulnerability

Norbert Szetei discovered that Django incorrectly handled the GIS functions and aggregates on Oracle. A remote attacker could possibly use this issue to perform an SQL injection attack...

CVE-2020-9402

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escapi...

UBUNTU-CVE-2020-9402

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escapi...

PT-2020-5130

Name of the Vulnerable Software and Affected Versions Django versions 1.11 before 1.11.29 Django versions 2.2 before 2.2.11 Django versions 3.0 before 3.0.4 Description The issue allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By...

The vulnerability of the AdminURLFieldWidget function in the Django web development framework relates to the lack of protective measures for website structure, allowing attackers to compromise data integrity.

The vulnerability of the AdminURLFieldWidget function in the Django web development framework is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to compromise data integrity...

The vulnerability of the `format()` function in the Django web development framework allows a attacker to trigger a denial-of-service attack. [source-iocs-preserved method=django.utils.numberformat.format()]

The vulnerability of the django.utils.numberformat.format function in the Django web development framework is related to uncontrolled memory consumption, which can lead to a complete exhaustion of resources. Exploiting this vulnerability may allow an attacker to cause a service failure...

Django -- potential SQL injection vulnerability

MITRE CVE reports: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was...

Exploit for SQL Injection in Djangoproject Django

CVE-2020-7471 This repository provides environments and P...

Debian: Security Advisory (DSA-4629-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4629-1 : python-django - security update

Simon Charette discovered that Django, a high-level Python web development framework, did not properly handle input in its PostgreSQL module. A remote attacker could leverage this to perform SQL injection attacks. C Tenable Network Security, Inc. The descriptive text and package checks in this...

[SECURITY] [DSA 4629-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4629-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 19, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4629-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4629-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 19, 2020 https://www.debian.org/security/faq -...

DSA-4629-1 python-django - security update

Bulletin has no description...

SQL injection in Django

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter. By passing a suitably crafted delimiter...