django CMS 'page_attribute' Template HTML 注入漏洞

BUGTRAQ ID: 57559 django CMS是用pony作为技术支持的CMS，可以前端编辑。 django CMS 2.3.5 之前版本的pageattribute模板标签没有正确过滤，在实现上存在HTML注入漏洞，成功利用后可允许在受影响浏览器中执行HTML和脚本代码。 0 django CMS 2.x 厂商补丁： django CMS ---------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载2.3.5版本： https://www.django-cms.org/en/...

FreeBSD : django-cms -- XSS Vulnerability (3886cafe-668c-11e2-94b8-1c4bd681f0cf)

Cross-site scripting XSS vulnerability Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the pageattribute template tag. Only users with admin access and the permission to edit at least one django CMS page objec...

Fedora 18 : python-django-1.4.3-1.fc18 (2012-20179)

https://www.djangoproject.com/weblog/2012/dec/10/security/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

FreeBSD : django -- multiple vulnerabilities (1b769b72-582b-11e2-b66b-00e0814cab4e)

The Django Project reports : - Host header poisoning Several earlier Django security releases focused on the issue of poisoning the HTTP Host header, causing Django to generate URLs pointing to arbitrary, potentially-malicious domains. In response to further input received and reports of continui...

Fedora Update for Django FEDORA-2012-20224

Check for the Version of Django OpenVAS Vulnerability Test Fedora Update for Django FEDORA-2012-20224 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Mandriva Update for python-django MDVSA-2012:181 (python-django)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for Django FEDORA-2012-20224

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[SECURITY] Fedora 17 Update: Django-1.4.3-1.fc17

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Fedora 17 : Django-1.4.3-1.fc17 (2012-20224)

https://www.djangoproject.com/weblog/2012/dec/10/security/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Mandriva Linux Security Advisory : python-django (MDVSA-2012:181)

Multiple host header poisoning flaws were found and fixed in Django. The updated packages have been upgraded to the 1.3.5 version which is not affected by these issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

django -- multiple vulnerabilities

The Django Project reports: Host header poisoning Several earlier Django security releases focused on the issue of poisoning the HTTP Host header, causing Django to generate URLs pointing to arbitrary, potentially-malicious domains. In response to further input received and reports of continuing...

django-cms -- XSS Vulnerability

Cross-site scripting XSS vulnerability Jonas Obrist reports: The security issue allows users with limited admin access to elevate their privileges through XSS injection using the pageattribute template tag. Only users with admin access and the permission to edit at least one django CMS page objec...

Fedora 18 : python-django-horizon-2012.2-4.fc18 (2012-18185)

drop python-cloudfiles as requirement - fix CVE-2012-5474 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 18 Update: python-django-horizon-2012.2-4.fc18

Horizon is a Django application for providing Openstack UI components. It allows performing site administrator viewing account resource usage, configuring users, accounts, quotas, flavors, etc. and end user operations start/stop/delete instances, create/restore snapshots, view instance VNC consol...

Ubuntu Update for python-django USN-1632-2

Ubuntu Update for Linux kernel vulnerabilities USN-1632-2 OpenVAS Vulnerability Test $Id: gbubuntuUSN16322.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for python-django USN-1632-2 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.ne...

Ubuntu: Security Advisory (USN-1632-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : python-django regression (USN-1632-2)

USN-1632-1 fixed a vulnerability in Django. The upstream fix introduced testsuite failures when ADMINS and/or MANAGERS were defined in settings.py. This update fixes the problem. We apologize for the inconvenience. James Kettle discovered Django did not properly filter the Host HTTP header when...

USN-1632-2: Django regression

USN-1632-1 fixed a vulnerability in Django. The upstream fix introduced testsuite failures when ADMINS and/or MANAGERS were defined in settings.py. This update fixes the problem. We apologize for the inconvenience. Original advisory details: James Kettle discovered Django did not properly filter...

Ubuntu Update for python-django USN-1632-1

Ubuntu Update for Linux kernel vulnerabilities USN-1632-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN16321.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for python-django USN-1632-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.ne...

Ubuntu: Security Advisory (USN-1632-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...