7628 matches found
CVE-2018-7537
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a...
UBUNTU-CVE-2018-7537
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a...
Information Exposure
Overview django is a Python Web framework. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. The django.utils.html.urlize function was extremely slow to evaluate certain inputs due to catastrophic backtracking in two regular expressions. The...
Regular Expression Denial of Service (ReDoS)
Overview django is a Python Web framework. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. If django.utils.text.Truncator's chars and words methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due t...
[ASA-201803-5] python-django: denial of service
Arch Linux Security Advisory ASA-201803-5 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package...
PT-2018-18141
Name of the Vulnerable Software and Affected Versions Django versions 2.0 through 2.0.2 Django versions 1.11 through 1.11.10 Django versions 1.8 through 1.8.18 Description An issue was discovered in the django.utils.html.urlize function, which was extremely slow to evaluate certain inputs due to...
PT-2018-1903
Name of the Vulnerable Software and Affected Versions Django versions 2.0 before 2.0.3 Django versions 1.11 before 1.11.11 Django versions 1.8 before 1.8.19 Description The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the django.utils.text.Truncato...
[ASA-201803-6] python2-django: denial of service
Arch Linux Security Advisory ASA-201803-6 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python2-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package...
Regular Expression Denial of Service (ReDoS)
Overview django-cacheops is an app that supports automatic or manual queryset caching and automatic granular event-driven invalidation. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS attacks. This can cause an impact of about 10 seconds matching tim...
Fedora Update for python-django FEDORA-2018-2c612c6d92
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora 27 : python-django (2018-2c612c6d92)
update to 1.11.10, fix for CVE-2018-6188: Information leakage in AuthenticationForm Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...
Ubuntu 17.10 : python-django vulnerabilities (USN-3559-1)
It was discovered that Django incorrectly handled certain requests. An attacker could possibly use this to access sensitive information. CVE-2017-12794, CVE-2018-6188. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...
Debian DSA-4107-1 : django-anymail - security update
It was discovered that the webhook validation of Anymail, a Django email backends for multiple ESPs, is prone to a timing attack. A remote attacker can take advantage of this flaw to obtain a WEBHOOKAUTHORIZATION secret and post arbitrary email tracking events. C Tenable Network Security, Inc. Th...
[SECURITY] [DSA 4107-1] django-anymail security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4107-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2018 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4107-1] django-anymail security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4107-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2018 https://www.debian.org/security/faq -...
USN-3559-1: Django vulnerabilities
It was discovered that Django incorrectly handled certain requests. An attacker could possibly use this to access sensitive information. CVE-2017-12794, CVE-2018-6188...
DSA-4107-1 django-anymail - security update
Bulletin has no description...
Debian: Security Advisory (DSA-4107-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2018-6188
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirmloginallowed method, as demonstrated by discovering whether a user account is inactive...
Input validation
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirmloginallowed method, as demonstrated by discovering whether a user account is inactive...