9010 matches found
Astra Linux – Vulnerability in Python-Django
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is vulnerable to SQL injection when column aliases containing periods are used, provided that the same alias is used in FilteredRelation through a properly crafted dictionary expansion...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. This issue arises due to the use of the Django Template Language’s variable resolution logic. The dictsort template filter is potentially vulnerable to information disclosure, or an unintended method call...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are vulnerable to a denial-of-service attack due to very large inputs containing a specific sequence of characters...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget, are susceptible to a potential denial-of-service attack due to certain inputs containing a very large number of Unicode characters...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2. The intcomma template filter was susceptible to a denial-of-service attack when used with very long strings...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs e.g., an excessive number of parts to multipart forms could result in too many open files or memory exhaustion, and posed a potential vector for a...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters are vulnerable to a denial-of-service attack due to very large inputs containing a specific sequence of characters...
Astra Linux – Vulnerability in Python-Django
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True, as well as the truncatewordshtml template filter, are vulnerable to a denial-of-service attack via a crafted regular expression. NOTE: This issue persists due to an...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. The algorithmic complexity in django.core.serializers.xmlserializer.getInnerText allows a remote attacker to trigger a potential denial-of-service attack, resulting in CPU and memory exhaustion through specially...
Astra Linux – Vulnerability in Python-Django
A vulnerability was discovered in versions prior to 6.0.0, 6.0.2, 5.2.0 prior to 5.2.1.1, and 4.2.0 prior to 4.2.2.8. The methods django.utils.text.Truncator.chars and Truncator.words with html=True, along with the template filters truncatecharshtml and truncatewordshtml, allow a remote attacker ...
Astra Linux – Vulnerability in Python-Django
An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Permissions for inline model instances were not validated when submitting forged POST data in GenericInlineModelAdmin. Earlier, unsupported Django versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated and...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...
Astra Linux – Vulnerability in Python-Django
In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validateipv4address, and validateipv46address did not prohibit leading zero characters in octal literals. This may allow bypassing access control based on IP addresses. validateipv4address and validateipv46address...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 5.0, prior to versions 5.0.7 and 4.2, prior to version 4.2.14. The derived classes of the django.core.files.storage.Storage base class, when they override generatefilename without replicating the file-path validations from the parent class, may allow directory...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django versions 5.1.1, 5.0.9, and 4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view that implements password reset processes, allows remote attackers to enumerate user email addresses by sending password reset requests and observing the...
CVE-2026-90806: Missing Authorization
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...
PT-2026-91287
A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk views.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out...
CLSA-2026-1789128267 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.post8+tuxcare...