PYSEC-2011-11

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

CVE-2011-0696

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged AJAX requests that leverage a "combination of browser plugins...

CVE-2011-0698

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / slash character in a key in a session cookie, related to session replays...

CVE-2011-0697

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

CVE-2011-0697

The CVE-2011-0697 entry maps to a Cross‑site Scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5, where an attacker could inject arbitrary script/HTML via the filename associated with a file upload. The issue arises from input handling in file uploads and results in ...

CVE-2011-0696

Technical details about CVE-2011-0696 are not publicly provided in the supplied documents; no affected products, versions, exploits, or fixes are stated here. Monitor for updates.

CVE-2011-0698

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / slash character in a key in a session cookie, related to session replays...

CVE-2011-0697

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

CVE-2011-0696

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged AJAX requests that leverage a "combination of browser plugins...

CVE-2011-0698

CVE-2011-0698 affects Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows, where a session cookie key containing a slash could allow directory traversal to read/execute files via session replays. The issue is triggered by a specific character in a session cookie and is documented across m...

CVE-2011-0696

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged AJAX requests that leverage a "combination of browser plugins...

CVE-2011-0697

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

CVE-2011-0698

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / slash character in a key in a session cookie, related to session replays...

[SECURITY] [DSA 2163-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2163-1 [email protected] http://www.debian.org/security/ Nico Golde February 14, 2011 http://www.debian.org/security/faq -...

CVE-2011-0697: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

CVE-2011-0697

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

CVE-2011-0696: Cross-Site Request Forgery (CSRF)

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via forged AJAX requests that leverage a "combination of browser plugins...

CVE-2011-0698: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / slash character in a key in a session cookie, related to session replays...

DSA-2163-1 python-django - multiple

Bulletin has no description...

PT-2011-2567

Name of the Vulnerable Software and Affected Versions Django versions 1.1.x through 1.1.3 Django versions 1.2.x through 1.2.4 Description A cross-site scripting XSS issue might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...