bugdoc (0.1.0), nemo (1.23.0) +1 more potentially affected by CVE-2021-33203 via django (1.11.28)

django PYPI version 1.11.28 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - bugdoc 0.1.0 - nemo 1.23.0 - pyxon 0.0.1 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

acclaim-badges (0.1.0), aimmo (>=0.1.0b2696.post0.dev1, <=0.27.4b5229) +100 more potentially affected by CVE-2021-33203 via django (1.10.8)

django PYPI version 1.10.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - acclaim-badges 0.1.0 - aimmo =0.1.0b2696.post0.dev1, =0.2.1, =2.0.0, =0.3.1, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =1.0.0, =1.1.0 -...

planadversity (1.0.2) potentially affected by CVE-2021-33203 via django (1.9.2)

django PYPI version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - planadversity 1.0.2 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

django-admin-caching (>=0.1.0, <=0.1.2), django-cognito (1.1.11) +3 more potentially affected by CVE-2021-33203 via django (1.10.0)

django PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-admin-caching =0.1.0, =2.0.0, =0.1.0, =0.3.1, =0.4.0 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2021-33203 via django (1.7.0)

django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2021-33203 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021...

configfactory (0.35.0.dev0), labeler (0.0.1) potentially affected by CVE-2021-33203 via django (1.11.4)

django PYPI version 1.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - configfactory 0.35.0.dev0 - labeler 0.0.1 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

koalix-crm (1.12.1), nemo (1.14.1) potentially affected by CVE-2021-33203 via django (1.11.21)

django PYPI version 1.11.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - koalix-crm 1.12.1 - nemo 1.14.1 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

alcali (>=2018.3.4, <=3003.1.0), archivebox (>=0.4.6, <=0.5.4) +224 more potentially affected by CVE-2021-33203 via django (>=3.0.0, <=3.1.11)

django PYPI version =3.0.0, =2018.3.4, =0.4.6, =1.0.0, =0.1.0, =0.1.0, =1.0.0b3, =0.1.3, =2.2.0, =0.18.0, =2.8.0, =0.0.1, =0.0.32, =0.0.33 and more Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

PYSEC-2021-99

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. validateipv4address and...

django-informixdb (>=0.1.2, <=0.1.3) potentially affected by CVE-2021-33203 via django (1.9.6)

django PYPI version 1.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-informixdb =0.1.2, =0.1.3 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

PYSEC-2021-98

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...

cosmicdb (>=0.0.19, <=0.0.24) potentially affected by CVE-2021-33203 via django (1.11.13)

django PYPI version 1.11.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdb =0.0.19, =0.0.24 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

aimmo (>=0.1.1a0.post0.dev60, <=0.1.1a0.post0.dev132), aldryn-boilerplates (0.7.4) +108 more potentially affected by CVE-2021-33203 via django (1.9.13)

django PYPI version 1.9.13 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.1.1a0.post0.dev60, =1.0.2, =1.1.1, =1.0.13, =1.0.7, =0.1.3, =0.2.0, =1.0.0, =0.2.136, =1.1.1, =1.2.1 and more Source cves: CVE-2021-33203...

cosmicdb (>=0.0.1, <=0.0.14), recarguide (0.0.1) potentially affected by CVE-2021-33203 via django (1.11.6)

django PYPI version 1.11.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdb =0.0.1, =0.0.14 - recarguide 0.0.1 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

CVE-2021-33571

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. validateipv4address and...

Directory traversal

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...

teamvault (0.6.1) potentially affected by CVE-2021-33203 via django (1.10.2)

django PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - teamvault 0.6.1 Source cves: CVE-2021-33203 Source advisory: OSV:PYSEC-2021-98...

CVE-2021-33203

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been...

alcali (>=2018.3.4, <=3003.1.0), archivebox (>=0.4.6, <=0.5.4) +224 more potentially affected by CVE-2021-33203 via django (>=3.0.0, <=3.1.11)

django PYPI version =3.0.0, =2018.3.4, =0.4.6, =1.0.0, =0.1.0, =0.1.0, =1.0.0b3, =0.1.3, =2.2.0, =0.18.0, =2.8.0, =0.0.1, =0.0.32, =0.0.33 and more Source cves: CVE-2021-33203 Source advisory: MEND:CVE-2021-33203...