CVE-2017-7233

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects namely django.utils.http.issafeurl considered some numeric URLs "safe" when they shouldn't be, aka an open...

CVE-2017-7234

A maliciously crafted URL to a Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 site using the django.views.static.serve view could redirect to any other domain, aka an open redirect vulnerability...

CVE-2017-7233

CVE-2017-7233 is a Django open redirect and XSS vulnerability caused by is_safe_url() misclassifying some numeric URLs as safe. Affected versions: Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18. Exploitation could allow remote attackers to redirect users to attacker-controlle...

CVE-2017-7233

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects namely django.utils.http.issafeurl considered some numeric URLs "safe" when they shouldn't be, aka an open...

CVE-2017-7234

A maliciously crafted URL to a Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 site using the django.views.static.serve view could redirect to any other domain, aka an open redirect vulnerability...

CVE-2017-7233

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects namely django.utils.http.issafeurl considered some numeric URLs "safe" when they shouldn't be, aka an open...

UBUNTU-CVE-2017-7234

A maliciously crafted URL to a Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 site using the django.views.static.serve view could redirect to any other domain, aka an open redirect vulnerability...

UBUNTU-CVE-2017-7233

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects namely django.utils.http.issafeurl considered some numeric URLs "safe" when they shouldn't be, aka an open...

CVE-2017-7234

A maliciously crafted URL to a Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 site using the django.views.static.serve view could redirect to any other domain, aka an open redirect vulnerability...

PT-2017-17595

Name of the Vulnerable Software and Affected Versions Django versions 1.10 before 1.10.7 Django versions 1.9 before 1.9.13 Django versions 1.8 before 1.8.18 Description The issue relies on user input to redirect the user to an "on success" URL. The security check for these redirects, namely...

django -- multiple vulnerabilities

Django team reports: These release addresses two security issues detailed below. We encourage all users of Django to upgrade as soon as possible. Open redirect and possible XSS attack via user-supplied numeric redirect URLs Open redirect vulnerability in django.views.static.serve...

PT-2017-17596

Name of the Vulnerable Software and Affected Versions Django versions 1.8 through 1.8.18 Django versions 1.9 through 1.9.13 Django versions 1.10 through 1.10.7 Description A maliciously crafted URL to a Django site using the django.views.static.serve view could redirect to any other domain. This...

Udemy: CSRF Token Design Flaw

Our django site uses their standard CSRF implementation. The reporter has their own ideas about how CSRF protection should be implemented...

Cross site scripting vulnerability in django-epiceditor（CVE-2017-6591）

Introduction django-epiceditor A django app that allows the easy addition of EpicEditor markdown editor to a django form field, whether in a custom app or the Django Admin. The project url: https://pypi.python.org/pypi/django-epiceditor Environment django==1.10.6 django-epiceditor==0.2.3...

Cross site scripting

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

CVE-2017-6591

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

CVE-2017-6591

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

PYSEC-2017-86

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

PYSEC-2017-86

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

CVE-2017-6591

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...