13278 matches found
Cross-Site Scripting
Django-Rest-Framework, before 3.9.1, has a XSS vulnerability caused by disabled autoescaping in the default DRF Browsable API view templates...
GHSA-57H7-R3Q3-W57J Cross-Site Scripting
Django-Rest-Framework, before 3.9.1, has a XSS vulnerability caused by disabled autoescaping in the default DRF Browsable API view templates...
PT-2021-24383
Name of the Vulnerable Software and Affected Versions: Django-Rest-Framework versions prior to 3.9.1 Description: The issue is caused by disabled autoescaping in the default DRF Browsable API view templates, leading to a XSS vulnerability. Recommendations: For versions prior to 3.9.1, update to...
Security fix for the ALT Linux 10 package python3-module-django version 2.2.19-alt1
Feb. 24, 2021 Alexey Shabalin 2.2.19-alt1 - 2.2.19 - rename package to python3-module-django back - Fixes for the following security vulnerabilities: + CVE-2021-3281 Potential directory-traversal via archive.extract + CVE-2021-23336 Web cache poisoning via django.utils.http.limitedparseqsl...
Ubuntu: Security Advisory (USN-4742-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Django Improper Access Control Disclosure
The vulnerability of the Django web application framework is related to incorrect default access rights settings. Exploiting this vulnerability allows a malicious actor to disclose protected information remotely...
Django FILE_UPLOAD_DIRECTORY_PERMISSIONS Disclosure
The vulnerability of the Django web application development framework’s FILEUPLOADDIRECTORYPERMISSIONS implementation is related to incorrect default access rights settings. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...
USN-4742-1: Django vulnerability
It was discovered that Django incorrectly accepted semicolons as query parameters. A remote attacker could possibly use this issue to perform a Web Cache Poisoning attack...
USN-4742-1 python-django vulnerability
It was discovered that Django incorrectly accepted semicolons as query parameters. A remote attacker could possibly use this issue to perform a Web Cache Poisoning attack...
CVE-2020-35681
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
CVE-2020-35681
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
DEBIAN-CVE-2020-35681
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
PYSEC-2021-113
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
CVE-2020-35681
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
UBUNTU-CVE-2020-35681
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
Design/Logic Flaw
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
PYSEC-2021-113
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
CVE-2020-35681
Technical details about CVE-2020-35681 are not publicly available in the provided connected documents. The sources repeat the vulnerability description but do not expose affected versions, exploitation specifics, mitigations, or patch availability. Monitor for updates.
CVE-2020-35681
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...
CVE-2020-35681
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channe...