arpegio (>=0.1.3, <=0.3.4), django-versatileimagefield (1.6.1) +2 more potentially affected by CVE-2021-25291 via pillow (3.3.3)

pillow PYPI version 3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - arpegio =0.1.3, =0.6.12a3, =0.6.12 Source cves: CVE-2021-25291 Source advisory: OSV:PYSEC-2021-37...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2021-25289 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2021-25289 Source advisory:...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2021-25290 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2021-25290 Source advisory: OSV:PYSEC-2021-36...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2021-25291 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2021-25291 Source advisory: OSV:PYSEC-2021-37...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2021-25291 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2021-25291 Source advisory:...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2021-25292 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2021-25292 Source advisory:...

Django Incorrect Default Permissions

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used. FILEUPLOADDIRECTORYPERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level...

ariadne-jwt (>=0.1.0, <=0.1.3), balder (0.1.24) +30 more potentially affected by CVE-2020-24583 via django (>=3.1.0a1, <=3.1.0)

django PYPI version =3.1.0a1, =0.1.0, =20.13.1, =0.1.0, =0.10.0, =0.9.0, =0.4.0, =0.12.0, =0.5.0, =0.7.0, =0.8.0, =0.13.2 and more Source cves: CVE-2020-24583 Source advisory: GHSA-M6GJ-H9GM-GW44...

ariadne-jwt (>=0.1.0, <=0.1.3), balder (0.1.24) +30 more potentially affected by CVE-2020-24583 via django (>=3.1.0a1, <=3.1.0)

django PYPI version =3.1.0a1, =0.1.0, =20.13.1, =0.1.0, =0.10.0, =0.9.0, =0.4.0, =0.12.0, =0.5.0, =0.7.0, =0.8.0, =0.13.2 and more Source cves: CVE-2020-24583 Source advisory: OSV:GHSA-M6GJ-H9GM-GW44...

GHSA-M6GJ-H9GM-GW44 Django Incorrect Default Permissions

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used. FILEUPLOADDIRECTORYPERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level...

GHSA-FR28-569J-53C4 Django Incorrect Default Permissions

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used. The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077...

ariadne-jwt (>=0.1.0, <=0.1.3), balder (0.1.24) +28 more potentially affected by CVE-2020-24584 via django (3.1.0)

django PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ariadne-jwt =0.1.0, =20.13.1, =0.1.0, =0.10.0, =0.9.0, =0.4.0, =0.12.0, =0.5.0, =0.7.0, =0.8.0, =2.0.4, =2.0.6 and more Source cves: CVE-2020-24584...

alcali (>=2018.3.4, <=3000.1.0), archivebox (>=0.4.6, <=0.4.21) +58 more potentially affected by CVE-2020-24584 via django (>=3.0.0, <=3.0.9)

django PYPI version =3.0.0, =2018.3.4, =0.4.6, =0.1.3, =0.0.1, =1.2.0, =0.2.0, =0.2.1, =0.8.0, =0.9.4 and more Source cves: CVE-2020-24584 Source advisory: GHSA-FR28-569J-53C4...

alcali (>=2018.3.1, <=2019.2.3), ambition-edc (>=0.3.62, <=0.3.72) +79 more potentially affected by CVE-2020-24584 via django (>=2.2.0, <=2.2.15)

django PYPI version =2.2.0, =2018.3.1, =0.3.62, =4.7.0, =4.10.0, =5.2.1, =0.1.0, =1.0.1, =0.0.30, =0.0.1, =0.0.1, =2.0.0, =1.1.34, =1.1.45 - django-country-filter 0.0.1 and more Source cves: CVE-2020-24584 Source advisory: GHSA-FR28-569J-53C4...

Django Incorrect Default Permissions

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 when Python 3.7+ is used. The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077...

alcali (>=2018.3.4, <=3000.1.0), archivebox (>=0.4.6, <=0.4.21) +58 more potentially affected by CVE-2020-24584 via django (>=3.0.0, <=3.0.9)

django PYPI version =3.0.0, =2018.3.4, =0.4.6, =0.1.3, =0.0.1, =1.2.0, =0.2.0, =0.2.1, =0.8.0, =0.9.4 and more Source cves: CVE-2020-24584 Source advisory: OSV:GHSA-FR28-569J-53C4...

alcali (>=2018.3.4, <=3000.1.0), archivebox (>=0.4.6, <=0.4.21) +59 more potentially affected by CVE-2021-3281 via django (>=3.0.0, <=3.0.11)

django PYPI version =3.0.0, =2018.3.4, =0.4.6, =0.1.3, =0.0.1, =1.2.0, =0.2.0, =0.2.1, =0.8.0, =0.9.4 and more Source cves: CVE-2021-3281 Source advisory: OSV:GHSA-FVGF-6H6H-3322...

Django Directory Traversal via archive.extract

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method used by "startapp --template" and "startproject --template" allows directory traversal via an archive with absolute paths or relative paths with dot segments...

GHSA-FVGF-6H6H-3322 Django Directory Traversal via archive.extract

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method used by "startapp --template" and "startproject --template" allows directory traversal via an archive with absolute paths or relative paths with dot segments...

archivebox (>=0.5.0, <=0.5.4), ariadne-jwt (>=0.1.0, <=0.1.3) +53 more potentially affected by CVE-2021-3281 via django (>=3.1.0, <=3.1.5)

django PYPI version =3.1.0, =0.5.0, =0.1.0, =1.0.0b3, =0.0.32, =0.0.38, =20.13.1, =0.1.0, =0.10.0, =0.9.0, =0.4.0, =0.7.3 and more Source cves: CVE-2021-3281 Source advisory: GHSA-FVGF-6H6H-3322...