7629 matches found
CVE-2018-16984
CVE-2018-16984 affects Django 2.1 before 2.1.2, where unprivileged admin users with view permissions can see full password hashes in the change form. The issue is due to bypassing the read-only password widget used to obfuscate hashes. Public records across multiple feeds (including Debian/ALT Li...
CVE-2018-16984
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission new in Django 2.1...
CVE-2018-16984
An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission new in Django 2.1...
PT-2018-13817
Name of the Vulnerable Software and Affected Versions Django versions 2.1 through 2.1.1 Django versions prior to 2.1.2 Description An issue allows unprivileged users to read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated...
Django -- password hash disclosure
Django release notes: CVE-2018-16984: Password hash disclosure to "view only" admin users If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view but not change permission to the user model were...
[ASA-201810-5] python-django: information disclosure
Arch Linux Security Advisory ASA-201810-5 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-16984 Package : python-django Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-773 Summary ======= The package python-django...
Security update for python-Django (moderate)
This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the...
MicroPyramid Django-CRM Cross-Site Request Forgery Vulnerability
MicroPyramid Django-CRM is an open source customer relationship management system CRM based on the Django framework . A cross-site request forgery vulnerability exists in the /users/create/, /users//edit/, and /accounts//delete/ URIs in MicroPyramid Django-CRM version 0.2. A remote attacker can...
CVE-2018-16552
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...
PYSEC-2018-65
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...
CVE-2018-16552
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...
Cross site request forgery (csrf)
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...
CVE-2018-16552
MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users//edit/, and /accounts//delete/ URIs...
CVE-2018-16552
MicroPyramid Django-CRM 0.2 is affected by a CSRF vulnerability in the /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs. The issue is documented across multiple sources (OSV/GHSA/CNVD/NVD) as CSRF for these endpoints. The connected documents do not provide root-cause details beyond ...
Facebook Flaw Allowed Remote Commands
A vulnerability in a Facebook server that could have led to information disclosure and command execution has been patched by the social network. At issue was a Sentry service, which is an open-source error tracking application that helps developers monitor and fix crashes in real time. It’s writt...
openSUSE Security Update : python-Django (openSUSE-2018-914)
This update for python-Django to version 2.08 fixes the following issues : The following security vulnerability was fixed : - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed : - Fixed a regression in Django 2.0.7 that broke the...
Seagate Personal Cloud SRN21C 4.3.16.0 4.3.18.0 - SQL Injection
Seagate Personal Cloud SRN21C 4.3.16.0 4.3.18.0 - SQL Injection ------------------------------------------------------------------------ Seagate Media Server multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Yorick Koster, September 20...
Seagate Personal Cloud SRN21C 4.3.16.0 / 4.3.18.0 - SQL Injection
------------------------------------------------------------------------ Seagate Media Server multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Yorick Koster, September 2017...
Security update for python-Django (moderate)
This update for python-Django to version 2.08 fixes the following issues: The following security vulnerability was fixed: - CVE-2018-14574: Fixed an redirection vulnerability in CommonMiddleware boo1102680 The following other bugs were fixed: - Fixed a regression in Django 2.0.7 that broke the...
Seagate Personal Cloud SRN21C SQL Injection
------------------------------------------------------------------------ Seagate Media Server multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Yorick Koster, September 2017...