Design/Logic Flaw

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

CVE-2015-3982

CVE-2015-3982 affects Django (1.8.x) with the session flush in the cached_db backend: flushing the session can set an empty string as the session key, allowing remote attackers to hijack user sessions. The vulnerability is fixed starting with Django 1.8.2 and related security updates. Affected co...

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

PT-2015-6370

Name of the Vulnerable Software and Affected Versions Django versions 1.8.0 through 1.8.1 Description The issue is related to the session.flush function in the cached db backend, which does not properly flush the session. This allows remote attackers to hijack user sessions via an empty string in...

Fedora 22 : python-django-1.8.2-1.fc22 (2015-8691)

fix CVE-2015-3982 - Fixed session flushing in the cacheddb backend Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

FreeBSD : django -- Fixed session flushing in the cached_db backend (48504af7-07ad-11e5-879c-00e0814cab4e)

The Django project reports : A change to session.flush in the cacheddb session backend in Django 1.8 mistakenly sets the session key to an empty string rather than None. An empty string is treated as a valid session key and the session cookie is set accordingly. Any users with an empty string in...

[SECURITY] Fedora 22 Update: python-django-1.8.2-1.fc22

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Django 'session.flush()' Security Bypass Vulnerability

Django is an open source web application framework using the Python language . An error in the Django 'session.flush' function allows remote attackers to bypass security restrictions and gain access to restricted accounts...

CVE-2015-3982

The session.flush function in the cacheddb backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key...

django -- Fixed session flushing in the cached_db backend

The Django project reports: A change to session.flush in the cacheddb session backend in Django 1.8 mistakenly sets the session key to an empty string rather than None. An empty string is treated as a valid session key and the session cookie is set accordingly. Any users with an empty string in...

Fortigate FortiManager 1000D Multiple Privilege Escalation Vulnerabilities

FortiManager Security Management appliances allow you to centrally manage any number of Fortinet Network Security devices,from several to thousands, including FortiGate®, FortiWiFi™, and FortiCarrier™. Fortimanager is vulnerable to multiple privilege escalation attacks, including root jailbreak...

[SECURITY] [DSA 3230-1] django-markupfield security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3230-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini April 20, 2015 http://www.debian.org/security/faq -...

django-markupfield Arbitrary File Read Vulnerability

Django is the Python programming language driven by an open source model-view-controller style Web application framework. Versions prior to django-markupfield 1.3.2 use the default docutils RESTRUCTUREDTEXTFILTERSETTINGS setting, which allows remote attackers to exploit vulnerabilities to include...

CVE-2015-0846

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...

DEBIAN-CVE-2015-0846

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...

CVE-2015-0846

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...

CVE-2015-0846

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...

PYSEC-2015-12

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...

Default credentials

django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXTFILTERSETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors...