CVE-2022-21683 Comment reply notifications sent to incorrect users in wagtail

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...

CVE-2022-21683 Comment reply notifications sent to incorrect users in wagtail

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...

CVE-2022-21683

Wagtail CVE-2022-21683 affects the notification logic for new replies in comment threads. The issue caused notifications to be sent to all users who have commented or replied anywhere on the site, rather than only to participants within the active thread. This could allow users without editing ac...

SUSE-SU-2022:0103-1 Security update for python-Django1

This update for python-Django1 fixes the following issues: - CVE-2021-45115: Fixed denial-of-service possibility in UserAttributeSimilarityValidator bsc1194115. - CVE-2021-45116: Fixed potential information disclosure in dictsort template filter bsc1194117. - CVE-2021-45452: Fixed potential...

SUSE-SU-2022:0102-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2021-45115: Fixed denial-of-service possibility in UserAttributeSimilarityValidator bsc1194115. - CVE-2021-45116: Fixed potential information disclosure in dictsort template filter bsc1194117. - CVE-2021-45452: Fixed potential...

CVE-2022-21683: Exposure of Sensitive Information to an Unauthorized Actor

Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that ...

Django Cross-Site Scripting Vulnerability (CNVD-2022-08043)

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes object-oriented mapper , view system , template system and so on. Django has a cross-site scripting vulnerability in version 3.7.3 that stems from not validating th...

Information Disclosure

python-django is vulnerable to information disclosure. The vulnerability exist due to the lack of sanitizaton of the Template Language's variable resolution logic...

Cross-site Scripting in django-cms

Django CMS 3.7.3 does not validate the plugintype parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting XSS vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user...

GHSA-HX7C-QPFQ-XCRP Cross-site Scripting in django-cms

Django CMS 3.7.3 does not validate the plugintype parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting XSS vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user...

blockies (0.0.1), demosys-py (>=0.1.2, <=0.3.12) +17 more potentially affected by CVE-2022-22815 via pillow (4.0.0)

pillow PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - blockies 0.0.1 - demosys-py =0.1.2, =0.0.2, =1.6.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =0.1.0, =3.0.0 and more Source cves:...

django-codenerix (1.0.0) potentially affected by CVE-2022-22815 via pillow (2.6.1)

pillow PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-codenerix 1.0.0 Source cves: CVE-2022-22815 Source advisory: OSV:GHSA-PW3C-H7WP-CVHX...

aperture-cli (>=0.0.0.dev1, <=1.0.0), aperturelib (>=0.0.0.dev1, <=1.0.0) +27 more potentially affected by CVE-2022-22815 via pillow (5.0.0)

pillow PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aperture-cli =0.0.0.dev1, =0.0.0.dev1, =0.0.1.dev1, =0.0.2, =0.2.0, =0.1.2, =0.1.9, =0.1.0, =1.0.0, =0.7.0, =0.9.8, =1.0.1, =1.0.2.post2 and more...

arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2022-22815 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2022-22815 Source advisory: OSV:GHSA-PW3C-H7WP-CVHX...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2022-22815 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2022-22815 Source advisory:...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2022-22815 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2022-22815 Source advisory: OSV:GHSA-PW3C-H7WP-CVHX...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2022-22815 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2022-22815 Source advisory: OSV:GHSA-PW3C-H7WP-CVHX...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2022-22816 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2022-22816 Source advisory: OSV:GHSA-XRCV-F9GM-V42C...

arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2022-22816 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2022-22816 Source advisory: OSV:GHSA-XRCV-F9GM-V42C...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2022-22816 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2022-22816 Source advisory: OSV:GHSA-XRCV-F9GM-V42C...