8989 matches found
CVE-2007-0404
CVE-2007-0404 affects Django 0.95. The vulnerability lies in bin/compile-messages.py, which invokes msgfmt via os.system without quoting argument strings, allowing an attacker to inject shell metacharacters via a (1) .po or (2) .mo file and execute arbitrary commands. The underlying cause is unsa...
CVE-2007-0405: Undefined Security Weakness
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user...
PT-2007-1875
Name of the Vulnerable Software and Affected Versions Django version 0.95 Description The issue arises from the bin/compile-messages.py script in Django, which fails to properly quote argument strings before invoking the msgfmt program through the os.system function. This oversight allows attacke...
CVE-2007-0404
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a 1 .po or 2 .mo file...
CVE-2007-0404
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a 1 .po or 2 .mo file...
CVE-2007-0405
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user...
CVE-2007-0405
The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user...