CVE-2015-0221

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

CVE-2015-0219

CVE-2015-0219 affects Django: WSGI headers can be spoofed when an underscore is used instead of a dash in HTTP header names (e.g., X-Auth_User). Affected versions are Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3. The root cause is unclear from the provided initial document, b...

CVE-2015-0221

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

CVE-2015-0219

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

CVE-2015-0221

The CVE-2015-0221 issue affects Django’s django.views.static.serve: reading served files one line at a time can cause memory exhaustion (DoS) when a file contains long lines. Publicly documented in GHSA-jhjg-w2cp-5j44 and echoed by Debian/Ubuntu/openSUSE advisories; Django fixed by reading files ...

CVE-2015-0219

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

CVE-2015-0222

CVE-2015-0222 affects Django 1.6.x (before 1.6.10) and 1.7.x (before 1.7.3). When ModelMultipleChoiceField is used with show_hidden_initial set to True, a remote attacker can trigger a denial-of-service by submitting duplicate values, causing a large number of SQL queries. The raised risk is a da...

CVE-2015-0220

The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL, related to redirect URLs, as demonstrated by a...

CVE-2015-0220

The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL, related to redirect URLs, as demonstrated by a...

CVE-2015-0220

The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL, related to redirect URLs, as demonstrated by a...

CVE-2015-0220

CVE-2015-0220 affects Django’s django.util.http.is_safe_url() where leading whitespace in user-supplied redirect URLs is not properly handled, enabling cross-site scripting via crafted redirects (e.g., a line feed followed by javascript:). Affected versions include Django 1.7.x before 1.7.3, 1.6....

CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

CVE-2015-0221

The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service memory consumption via a long line in a file...

CVE-2015-0219

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

Django 'ModelMultipleChoiceField' Denial of Service Vulnerability

Django is an open source web application framework written in Python . A denial of service vulnerability exists in Django 'ModelMultipleChoiceField', which could be exploited by a remote attacker to initiate a denial of service and refuse service to legitimate users...

Django 'django.views.static.serve()' function denial of service vulnerability

Django is an open source web application framework written in Python . A denial of service vulnerability exists in the Django 'django.views.static.serve' function, which could be exploited by a remote attacker to trigger a denial of service due to excessive resource consumption...

Django Security Bypass Vulnerability

Django is an open source web application framework written in Python . Django suffers from a security bypass vulnerability that can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations...

CVE-2015-0219: Undefined Security Weakness

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...