PT-2007-6792 · Django · Django

Name of the Vulnerable Software and Affected Versions: Django version 0.96 Description: A cross-site request forgery CSRF issue exists in the admin panel, allowing remote attackers to change passwords of arbitrary users via a request to "admin/auth/user/1/password/". This issue is disputed by...

Django 0.96 (stable) Admin Panel CSRF

Author: J. Carlos Nieto. Date: Oct 21, 2007 There exists a security hole in the default django's admin panel. Background ========== Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Django has an automatic admin panel that allows a person...

Design/Logic Flaw

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

PYSEC-2007-1

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

PYSEC-2007-1

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

DEBIAN-CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

CVE-2007-5712

The CVE-2007-5712 issue affects Django’s i18n framework (versions 0.91, 0.95, 0.95.1, 0.96) and is also observed when used in PyLucid. The vulnerability allows remote attackers to induce memory consumption (DoS) by sending many HTTP requests with large Accept-Language headers. Public docs record ...

CVE-2007-5712

The internationalization i18n framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USEI18N option and the i18n component are enabled, allows remote attackers to cause a denial of service memory consumption via many HTTP requests with large...

FreeBSD : py-django -- denial of service vulnerability (d2c2952d-85a1-11dc-bfff-003048705d5a)

Django project reports : A per-process cache used by Django's internationalization 'i18n' system to store the results of translation lookups for particular values of the HTTP Accept-Language header used the full value of that header as a key. An attacker could take advantage of this by sending...

django-csrf.txt

Author: J. Carlos Nieto. Date: Oct 21, 2007 There exists a security hole in the default django's admin panel. Background ========== Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Django has an automatic admin panel that allows a person...

py-django -- denial of service vulnerability

Django project reports: A per-process cache used by Django's internationalization "i18n" system to store the results of translation lookups for particular values of the HTTP Accept-Language header used the full value of that header as a key. An attacker could take advantage of this by sending...

[SA23826] Django Two Vulnerabilities

TITLE: Django Two Vulnerabilities SECUNIA ADVISORY ID: SA23826 VERIFY ADVISORY: http://secunia.com/advisories/23826/ CRITICAL: Moderately critical IMPACT: Security Bypass, System access WHERE: From remote SOFTWARE: Django 0.x http://secunia.com/product/13287/ DESCRIPTION: Some vulnerabilities hav...

Django消息文件远程任意命令执行漏洞

Django是Python编程语言驱动的一个开源模型-视图-控制器（MVC）风格的Web应用程序框架。 Django处理消息文件存在问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意命令。 问题是处理文件时不正确过滤用户提交的输入就直接使用Python 'os.system'函数调用，构建恶意.po文件，诱使用户访问处理，可导致以应用程序进程权限执行任意命令。 Django 0.95 可参考如下的安全补丁程序： http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=407519...

CVE-2007-0405

The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user...

CVE-2007-0405

The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user...

CVE-2007-0404

bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a 1 .po or 2 .mo file...