CVE-2015-0220: Improper Neutralization of Input During Web Page Generation

The django.util.http.issafeurl function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL, related to redirect URLs, as demonstrated by a...

PT-2015-4527

Name of the Vulnerable Software and Affected Versions Django versions 1.4.0 through 1.4.17 Django versions 1.6.0 through 1.6.9 Django versions 1.7.0 through 1.7.2 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL, related to redirect URLs...

CVE-2014-3730: Improper Input Validation

The django.util.http.issafeurl function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."...

PT-2014-5471

Name of the Vulnerable Software and Affected Versions Django versions 1.4 through 1.4.12 Django versions 1.5 through 1.5.7 Django versions 1.6 through 1.6.4 Django versions 1.7 through 1.7b3 Description The django.util.http.is safe url function does not properly validate URLs, allowing remote...