GLSA-201406-26 : Django: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-26 Django: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute code with the privileges ...

Django: Multiple vulnerabilities

Background Django is a Python-based web framework. Description Multiple vulnerabilities have been discovered in Django. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute code with the privileges of the process, modify SQL queries, or disclose...

[SECURITY] Fedora 19 Update: python-jinja2-2.6-7.fc19

Jinja2 is a template engine written in pure Python. It provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. If you have any exposure to other text-based template languages, such as Smarty or Django, you should feel right at home with...

[SECURITY] Fedora 19 Update: python-djblets-0.7.30-2.fc19

A collection of useful classes and functions for Django...

[SECURITY] Fedora 20 Update: python-djblets-0.7.30-2.fc20

A collection of useful classes and functions for Django...

CVE-2014-3994

Cross-site scripting XSS vulnerability in util/templatetags/djbletsjs.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user na...

CVE-2014-3995

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2014-3995

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

Cross site scripting

Cross-site scripting XSS vulnerability in util/templatetags/djbletsjs.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user na...

PYSEC-2014-78

Cross-site scripting XSS vulnerability in util/templatetags/djbletsjs.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user na...

PYSEC-2014-79

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

Cross site scripting

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2014-3994

Cross-site scripting XSS vulnerability in util/templatetags/djbletsjs.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user na...

CVE-2014-3994

CVE-2014-3994 is a cross-site scripting (XSS) vulnerability in Djblets’ util/templatetags/djblets_js.py used with Django/Review Board. Djblets versions before 0.7.30 and 0.8.x before 0.8.3 allow remote attackers to inject arbitrary script/HTML via a JSON object, demonstrated by the name field whe...

CVE-2014-3995

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2014-3995

Djblets gravatars.py XSS (CVE-2014-3995) affects Djblets for Django via user display name. The vulnerable code paths are in gravatars/templatetags/gravatars.py, with flaws present in versions before 0.7.30 and in 0.8.x before 0.8.3. Exploitation allows remote attackers to inject arbitrary web scr...

[SECURITY] [DSA 2934-1] python-django security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2934-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso May 19, 2014 http://www.debian.org/security/faq -...

openSUSE Security Update : python-django (openSUSE-SU-2013:1685-1)

python-django was updated to version 1.5.5 : + Readdressed denial-of-service via password hashers CVE-2013-1443 + Properly rotate CSRF token on login %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

openSUSE Security Update : python-django (openSUSE-SU-2012:0653-1)

python-django update version to 1.2.7 fixes several security issues including denial of service, CSRF and information leaks: https://www.djangoproject.com/weblog/2011/sep/10/127/ %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

openSUSE Security Update : python-django (openSUSE-SU-2013:1492-1)

This python-django update fixes several security issues. - Update to version 1.4.8 bnc840832, CVE-2013-1443 : + Fixed denial-of-service via large passwords - Changes from version 1.4.7 : + Fixed directory traversal with ssi template tag - Changes from version 1.4.6 : + Fixed Cross-site scripting...