Django Grappelli Input Validation Error Vulnerability

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in django-grappelli Django Grappelli prior to version 2.15.2, whi...

CVE-2021-46898

views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...

openSUSE 15 Security Update : python-Django (openSUSE-SU-2023:0310-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0310-1 advisory. - Denial-of-service possibility in django.utils.text.Truncator fedora-all CVE-2023-43665 Note that Nessus has not tested for this issue but has instead...

CVE-2021-46898

CVE-2021-46898 – django-grappelli protocol-relative URL redirect issue Affected component: views/switch.py in django-grappelli (also known as Django Grappelli) prior to version 2.15.2. The vulnerability arises from an approach that attempts to block external redirects using a startswith("/") chec...

Security update for python-Django (moderate)

openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2023:0309-1 Rating: moderate References: 1215978 Cross-References: CVE-2023-43665 CVSS scores: CVE-2023-43665 SUSE: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports...

Security update for python-Django (moderate)

openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2023:0310-1 Rating: moderate References: 1215978 Cross-References: CVE-2023-43665 CVSS scores: CVE-2023-43665 SUSE: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports...

OPENSUSE-SU-2023:0310-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-43665: Denial-of-service in django.utils.text.Truncator boo1215978...

OPENSUSE-SU-2023:0309-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-43665: Denial-of-service in django.utils.text.Truncator boo1215978...

CVE-2023-45809

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

Design/Logic Flaw

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

CVE-2023-45809

Vulnerability: Wagtail CMS (Django) exposes display names of user accounts via the admin bulk actions view when accessed by a limited-permission editor. Root cause: error messages disclose user display names; by tweaking URL parameters, a non-changeing editor can retrieve any user’s display name....

CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

python-django: Potential bypass of validation when uploading multiple files using one form field

A bypass of validation flaw was found in python-django. When uploading multiple files using one form field, an attacker could upload multiple files without validation due to the server only validating the last file uploaded...

python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

A regular expression denial of service vulnerability has been found in Django. Email and URL validators are vulnerable to this flaw when processing a very large number of domain name labels of emails and URLs...

python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``

An uncontrolled resource consumption vulnerability was found in Django. Feeding certain inputs with a very large number of Unicode characters to the URI to IRI encoder function can lead to a denial of service...

python-django: Denial-of-service possibility in django.utils.text.Truncator

An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs...

python-django: Potential denial of service vulnerability in ``django.utils.encoding.uri_to_iri()``

An uncontrolled resource consumption vulnerability was found in Django. Feeding certain inputs with a very large number of Unicode characters to the URI to IRI encoder function can lead to a denial of service...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.3 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Fedora: Security Advisory for python-django (FEDORA-2023-cc023fabb7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...