django-transcribe (>=0.3.5, <=0.5.17), odooku-odoo-account-invoicing (>=11.0.0, <=11.0.6) +35 more potentially affected by CVE-2021-28957 via lxml (3.5.0)

lxml PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - django-transcribe =0.3.5, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0,...

django-transcribe (>=0.3.5, <=0.5.17), odooku-odoo-account-invoicing (>=11.0.0, <=11.0.6) +35 more potentially affected by CVE-2021-28957 via lxml (3.5.0)

lxml PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - django-transcribe =0.3.5, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0,...

Fedora: Security Advisory for python-django (FEDORA-2021-e22bb0e548)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cross-site Scripting (XSS) in Django REST Framework

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious tags, leadin...

GHSA-FX83-3PH3-9J2Q Cross-site Scripting (XSS) in Django REST Framework

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious tags, leadin...

total.js Remote Code Execution Vulnerability

total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Remote Code Execution RCE via set. PoC js // To be ru...

Django Channels leakage of session identifiers using legacy AsgiHandler

Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...

GHSA-V542-8Q9X-CFFC Django Channels leakage of session identifiers using legacy AsgiHandler

Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...

[SECURITY] Fedora 34 Update: python-django-3.1.7-1.fc34

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2021-25289 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2021-25289 Source advisory: OSV:PYSEC-2021-35...

chromewhip (>=0.2.2, <=0.2.16), cloud-volume (>=0.6.12, <=0.8.1) +11 more potentially affected by CVE-2021-25290 via pillow (4.2.1)

pillow PYPI version 4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - chromewhip =0.2.2, =0.6.12, =4.4.1, =0.0.1a0, =0.9.0, =0.6.19a0, =0.3.5, =0.0.3, =11.0.0, =11.2.0 Source cves: CVE-2021-25290 Source advisory:...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2021-25290 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2021-25290 Source advisory:...

arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2021-25293 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2021-25293 Source advisory: OSV:PYSEC-2021-39...

aperture-cli (>=0.0.0.dev1, <=1.0.0), aperturelib (>=0.0.0.dev1, <=1.0.0) +27 more potentially affected by CVE-2021-25293 via pillow (5.0.0)

pillow PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aperture-cli =0.0.0.dev1, =0.0.0.dev1, =0.0.1.dev1, =0.0.2, =0.2.0, =0.1.2, =0.1.9, =0.1.0, =1.0.0, =0.7.0, =0.9.8, =1.0.1, =1.0.2.post2 and more...

balebot (>=1.2.8, <=1.8.15), demosys-py (>=1.0.6, <=2.0.3) +19 more potentially affected by CVE-2021-25293 via pillow (5.2.0)

pillow PYPI version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - balebot =1.2.8, =1.0.6, =0.3.0, =1.0.7, =1.2.1, =1.8.3, =2.1.0, =2.0.3, =2.1.0 - poltools 1.0.0 and more Source cves: CVE-2021-25293 Source advisory...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2021-25293 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2021-25293 Source advisory:...

django-codenerix (1.0.0) potentially affected by CVE-2021-25293 via pillow (2.6.1)

pillow PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-codenerix 1.0.0 Source cves: CVE-2021-25293 Source advisory: OSV:PYSEC-2021-39...

azureml-designer-classic-modules (>=0.0.127, <=0.0.129), azureml-designer-cv-modules (>=0.0.8, <=0.0.10) +17 more potentially affected by CVE-2021-25289 via pillow (7.1.0)

pillow PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - azureml-designer-classic-modules =0.0.127, =0.0.8, =0.0.10, =0.0.7, =0.0.7, =0.0.2, =0.3.1, =0.1.1, =0.0.2, =0.0.1, =0.0.4, =0.0.3, =0.1.0 - qweb...

django-codenerix (1.0.0) potentially affected by CVE-2021-25290 via pillow (2.6.1)

pillow PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-codenerix 1.0.0 Source cves: CVE-2021-25290 Source advisory: OSV:PYSEC-2021-36...

arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2021-25290 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2021-25290 Source advisory: OSV:PYSEC-2021-36...