django-epiceditor vulnerable to XSS in form field

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

GHSA-XP5M-4C9F-498Q django-epiceditor vulnerable to XSS in form field

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

GHSA-9PV8-Q5RX-C8GQ django_make_app is vulnerable to Code Injection

An exploitable vulnerability exists in the YAML parsing functionality in the readyamlfile method in ioutils.py in djangomakeapp 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability...

GHSA-HXF9-7H4C-F5JV Django-Anymail prone to a timing attack

webhooks/base.py in Anymail aka django-anymail before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOKAUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events...

Django-Anymail prone to a timing attack

webhooks/base.py in Anymail aka django-anymail before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOKAUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events...

SUSE-SU-2018:1830-1 Security update for python-Django

This update for python-Django fixes the following security issues: - CVE-2016-2512: The utils.http.issafeurl function allowed remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting XSS attacks via a URL containing basic...

SUSE-SU-2018:1828-1 Security update for python-Django

This update for python-Django fixes the following security issues: - CVE-2016-2512: The utils.http.issafeurl function allowed remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting XSS attacks via a URL containing basic...

Security Bulletin: Vulnerabilities in Django affect IBM SmartCloud Provisioning shipped with IBM SmartCloud Orchestrator (CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483).

Summary Vulnerabilities in Django affect IBM SmartCloud Provisioning, which is shipped with IBM SmartCloud Orchestrator CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483. Vulnerability Details Consult Vulnerabilities in Django affect SmartCloud Provisioning CVE 2014-0480, CVE 2014-0481,...

Security Bulletin: Vulnerabilities in Django affect SmartCloud Provisioning (CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483)

Summary Vulnerabilities found in Django as per August 2014 X-Force report CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483 affect SmartCloud Provisioning 2.3. SmartCloud Provisioning 2.3 is shipped with Django. Securities vulnerabilities have been discovered in Django that may affect...

Security Bulletin: SmartCloud Provisioning - Django vulnerabilities reported in April 2014 X-Force Report

Summary SmartCloud Provisioning - Django vulnerabilities reported in April 2014 X-Force Report CVE-2014-0473, CVE-2014-0474,CVE-2014-0472 Vulnerability Details CVE-ID: CVE-2014-0473 DESCRIPTION: Django is vulnerable to cross-site request forgery, caused by an error when handling caching of...

Security Bulletin: SmartCloud Provisioning - Django vulnerabilities reported in May 2014 X-Force Report

Summary SmartCloud Provisioning - Django vulnerabilities reported in May 2014 X-Force Report CVE-2014-1418, CVE-2014-3730. Vulnerability Details SmartCloud Provisioning 2.3 is shipped with Open Source Django. Securities vulnerabilities have been discovered in Django, which affect SmartCloud...

Smule: Disclosure of information about the system, configuration files.

Disclosure of django configuration via debug mode...

Seagate Personal Cloud Multiple Vulnerabilities(CVE-2018-5347)

Vulnerabilities summary The following advisory describes two 2 unauthenticated command injection vulnerabilities. Seagate Personal Cloud Home Media Storage is “the easiest way to store, organize, stream and share all your music, movies, photos, and important documents.” Credit An independent...

Authentication Bypass

django-allauth is vulnerable to authentication bypass attacks. The vulnerability exists as the checkpassword function used in the authentication backend failed to reject authentication to a user if isactive=False is set...

SUSE-SU-2018:1102-1 Security update for python-Django

This update for python-Django fixes the following issues: Security issues fixed: - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. bsc1083305 - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. bsc1083304 - CVE-2017-12794:...

Zulip Server Cross-Site Scripting Vulnerability

Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in versions of Zulip Server prior to 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Seagate Media Server SRN21C Cross Site Scripting

------------------------------------------------------------------------ Seagate Media Server stored Cross-Site Scripting vulnerability ------------------------------------------------------------------------ Yorick Koster, September 2017...

SUSE-SU-2018:0973-1 Security update for python-Django

This update for python-Django fixes the following issues: Security issues fixed: - CVE-2018-7537: Fixed catastrophic backtracking in django.utils.text.Truncator. bsc1083305 - CVE-2018-7536: Fixed catastrophic backtracking in urlize and urlizetrunc template filters. bsc1083304 - CVE-2017-12794:...

Insecure Randomness

django-oscar is contains a insecure randomness vulnerability. The vulnerability exists as the verificationhash method in the AbstractOrder model uses the MD5 hashing algorithm in an insecure way which allows attackers to perform a brute force attack to recover the site-wide secret key...

Debian DSA-4161-1 : python-django - security update

James Davis discovered two issues in Django, a high-level Python web development framework, that can lead to a denial-of-service attack. An attacker with control on the input of the django.utils.html.urlize function or django.utils.text.Truncator's chars and words methods could craft a string tha...