django-codenerix (1.0.0) potentially affected by CVE-2022-22816 via pillow (2.6.1)

pillow PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-codenerix 1.0.0 Source cves: CVE-2022-22816 Source advisory: OSV:GHSA-XRCV-F9GM-V42C...

arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2022-22817 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2022-22817 Source advisory: OSV:GHSA-8VJ2-VXX3-667W...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2022-22817 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2022-22817 Source advisory: OSV:GHSA-8VJ2-VXX3-667W...

GHSA-8C5J-9R9F-C6W8 Information disclosure in Django

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

Information disclosure in Django

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a...

Directory-traversal in Django

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

aimmo (>=0.61.9b59, <=1.3.3), alcali (>=2018.3.1, <=2019.2.3) +97 more potentially affected by CVE-2021-45452 via django (>=2.2.0, <=2.2.25)

django PYPI version =2.2.0, =0.61.9b59, =2018.3.1, =0.3.62, =0.14.0, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =4.15.0, =4.15.0, =1.0.1, =1.0.0, =0.0.30, =0.0.1, =0.0.5 and more Source cves: CVE-2021-45452 Source advisory: GHSA-JRH2-HC4R-7JWX...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), aedttest (>=0.0.1.dev1, <=0.0.1) +98 more potentially affected by CVE-2021-45452 via django (>=3.2.0, <=3.2.10)

django PYPI version =3.2.0, =1.0.1a0, =0.0.1.dev1, =1.0.0, =0.0.1, =0.2.0, =1.0.0b6, =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =22.0.0.dev0, =0.1.0, =21.1.2, =0.0.1, =0.0.3 and more Source cves: CVE-2021-45452 Source advisory: GHSA-JRH2-HC4R-7JWX...

apollo-sdk (>=0.2.0, <=0.2.11), audoma (>=0.6.1, <=0.6.10) +19 more potentially affected by CVE-2021-45452 via django (4.0.0)

django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.2.0, =0.6.1, =2.16.1, =1.0.7, =0.9.0, =0.9.0, =0.20.2, =0.70.0, =0.70.2 and more Source cves: CVE-2021-45452 Source advisory:...

apollo-sdk (>=0.2.0, <=0.2.11), audoma (>=0.6.1, <=0.6.10) +19 more potentially affected by CVE-2021-45452 via django (4.0.0)

django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - apollo-sdk =0.2.0, =0.6.1, =2.16.1, =1.0.7, =0.9.0, =0.9.0, =0.20.2, =0.70.0, =0.70.2 and more Source cves: CVE-2021-45452 Source advisory:...

GHSA-JRH2-HC4R-7JWX Directory-traversal in Django

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), aedttest (>=0.0.1.dev1, <=0.0.1) +98 more potentially affected by CVE-2021-45452 via django (>=3.2.0, <=3.2.10)

django PYPI version =3.2.0, =1.0.1a0, =0.0.1.dev1, =1.0.0, =0.0.1, =0.2.0, =1.0.0b6, =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =22.0.0.dev0, =0.1.0, =21.1.2, =0.0.1, =0.0.3 and more Source cves: CVE-2021-45452 Source advisory: OSV:GHSA-JRH2-HC4R-7JWX...

Denial-of-service in Django

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), aedttest (>=0.0.1.dev1, <=0.0.1) +99 more potentially affected by CVE-2021-45115 via django (>=3.2.0rc1, <=3.2.10)

django PYPI version =3.2.0rc1, =1.0.1a0, =0.0.1.dev1, =1.0.0, =0.0.1, =0.2.0, =1.0.0b6, =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =22.0.0.dev0, =0.1.0, =21.1.2, =0.0.1, =0.0.3 and more Source cves: CVE-2021-45115 Source advisory: GHSA-53QW-Q765-4FWW...

aimmo (>=0.61.9b59, <=1.3.3), alcali (>=2018.3.1, <=2019.2.3) +97 more potentially affected by CVE-2021-45115 via django (>=2.2.0, <=2.2.25)

django PYPI version =2.2.0, =0.61.9b59, =2018.3.1, =0.3.62, =0.14.0, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =4.15.0, =4.15.0, =1.0.1, =1.0.0, =0.0.30, =0.0.1, =0.0.5 and more Source cves: CVE-2021-45115 Source advisory: OSV:GHSA-53QW-Q765-4FWW...

admin-tool-button (>=1.0.1a0, <=1.0.5a0), aedttest (>=0.0.1.dev1, <=0.0.1) +99 more potentially affected by CVE-2021-45115 via django (>=3.2.0rc1, <=3.2.10)

django PYPI version =3.2.0rc1, =1.0.1a0, =0.0.1.dev1, =1.0.0, =0.0.1, =0.2.0, =1.0.0b6, =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =22.0.0.dev0, =0.1.0, =21.1.2, =0.0.1, =0.0.3 and more Source cves: CVE-2021-45115 Source advisory: OSV:GHSA-53QW-Q765-4FWW...

ae-django-utils (0.3.1), apollo-sdk (>=0.2.0, <=0.2.11) +32 more potentially affected by CVE-2021-45115 via django (>=4.0.0a1, <=4.0.0)

django PYPI version =4.0.0a1, =0.2.0, =0.6.1, =2.16.1, =0.1.5, =1.0.7, =0.9.0, =0.4.0a2, =0.1.0, =0.1.1 and more Source cves: CVE-2021-45115 Source advisory: OSV:GHSA-53QW-Q765-4FWW...

GHSA-53QW-Q765-4FWW Denial-of-service in Django

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user...

CVE-2021-44649

Django CMS 3.7.3 does not validate the plugintype parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting XSS vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user...

CVE-2021-44649

Django CMS 3.7.3 does not validate the plugintype parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting XSS vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user...