7626 matches found
Arbitrary File Upload
djangofiler is vulnerable to Arbitrary file upload. The vulnerability is due to improper input validation and the lack of neutralization of script-related HTML tags in django Filer, allows attackers to upload files with dangerous types and manipulate input data, leading to stored XSS...
python310-Django-5.1.4-1.1 on GA media (moderate)
python310-Django-5.1.4-1.1 on GA media Announcement ID: openSUSE-SU-2024:14568-1 Rating: moderate Cross-References: CVE-2024-53907 CVE-2024-53908 CVSS scores: CVE-2024-53907 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-53908 SUSE : 9.1...
Security update for python-Django
This update for python-Django fixes the following issues: CVE-2024-53907: Fixed denial-of-service in django.utils.html.striptags bsc1234232 CVE-2024-53908: Fixed SQL injection in HasKeylhs, rhs on Oracle bsc1234231 Patch Instructions: To install this SUSE update use the SUSE recommended...
SUSE-SU-2024:4285-1 Security update for python-Django
This update for python-Django fixes the following issues: - CVE-2024-53907: Fixed denial-of-service in django.utils.html.striptags bsc1234232 - CVE-2024-53908: Fixed SQL injection in HasKeylhs, rhs on Oracle bsc1234231...
OPENSUSE-SU-2024:14568-1 python310-Django-5.1.4-1.1 on GA media
These are all security issues fixed in the python310-Django-5.1.4-1.1 package on the GA media of openSUSE Tumbleweed...
Cross-Site Scripting (XSS)
djangocmsattributesfield is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper neutralization of input during web page generation in django CMS Attributes Fields, which allows stored XSS."...
python310-Django4-4.2.17-1.1 on GA media (moderate)
python310-Django4-4.2.17-1.1 on GA media Announcement ID: openSUSE-SU-2024:14565-1 Rating: moderate Cross-References: CVE-2024-53907 CVE-2024-53908 CVSS scores: CVE-2024-53907 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2024-53908 SUSE : 9.1...
OPENSUSE-SU-2024:14565-1 python310-Django4-4.2.17-1.1 on GA media
These are all security issues fixed in the python310-Django4-4.2.17-1.1 package on the GA media of openSUSE Tumbleweed...
Django 4.x < 4.2.17, 5.0.x < 5.0.10, 5.1.x < 5.1.4 Multiple Vulnerabilities - Windows
Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...
Django 4.x < 4.2.17, 5.0.x < 5.0.10, 5.1.x < 5.1.4 Multiple Vulnerabilities - Linux
Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...
The vulnerability of the django.db.models.fields.json class in the Django web application framework allows an attacker to execute arbitrary SQL code.
The vulnerability of the django.db.models.fields.json HasKey software platform for Django web applications is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary SQL code by sending a...
python310-django-ckeditor-6.7.2-1.1 on GA media (moderate)
python310-django-ckeditor-6.7.2-1.1 on GA media Announcement ID: openSUSE-SU-2024:14557-1 Rating: moderate Cross-References: CVE-2024-24815 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...
Django SQL injection in HasKey(lhs, rhs) on Oracle
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...
GHSA-8498-2H75-472J vulnerabilities
Vulnerabilities for packages: py3-django...
GHSA-8498-2H75-472J vulnerabilities
Vulnerabilities for packages: py3-django, awx...
GHSA-M9G8-FXXM-XG86 vulnerabilities
Vulnerabilities for packages: py3-django...
GHSA-M9G8-FXXM-XG86 vulnerabilities
Vulnerabilities for packages: py3-django, awx...
Django denial-of-service in django.utils.html.strip_tags()
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The striptags method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities...
GHSA-M9G8-FXXM-XG86 Django SQL injection in HasKey(lhs, rhs) on Oracle
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...