CVE-2017-6591

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field...

CVE-2017-6591

CVE-2017-6591 affects django-epiceditor 0.2.3 and is a cross-site scripting (XSS) vulnerability triggered by crafted content in a form field. The root cause is an input handling flaw that allows malicious payloads to be reflected or processed in a way that could execute script in a victim’s brows...

Security fix for the ALT Linux 10 package python3-module-django version 1.8.17-alt1

Feb. 2, 2017 Alexey Shabalin 1.8.17-alt1 - 1.8.17 - fixed CVE-2016-9013,CVE-2016-9014...

Security fix for the ALT Linux 9 package python3-module-django version 1.8.17-alt1

Feb. 2, 2017 Alexey Shabalin 1.8.17-alt1 - 1.8.17 - fixed CVE-2016-9013,CVE-2016-9014...

Python format string vulnerabilities in Django, for example-the vulnerability of early warning-the black bar safety net

! Author: phithon In the C language, there is a class of particularly interesting vulnerability, format string vulnerability. The light then destroy the memory, read and write any address of the content, binary content, I will not say, say to also do not understand, share the link...

Insecure Random Number Generator

django-simple-sso is vulnerable to brute force attacks due to it's insecure random number generator. The random number generator generates pseudo-random numbers rather than a cryptographically secure random number...

CVE-2016-9014

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

DEBIAN-CVE-2016-9014

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

ALPINE-CVE-2016-9014

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

CVE-2016-9014

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

DEBIAN-CVE-2016-9013

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...

CVE-2016-9013

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...

ALPINE-CVE-2016-9013

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...

CVE-2016-9013

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...

PYSEC-2016-17

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...

PYSEC-2016-18

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

Hardcoded credentials

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

Hardcoded credentials

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...

PYSEC-2016-17

Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually...

CVE-2016-9014

CVE-2016-9014 affects Django before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3. When settings.DEBUG is True, the HTTP Host header is not properly validated against settings.ALLOWED_HOSTS, enabling remote DNS rebinding attacks. Several connected advisories confirm this issue and recomme...