CVE-2021-42053

The Unicorn framework through 0.35.3 for Django allows XSS via component.name...

CVE-2021-42053

The Unicorn framework through 0.35.3 for Django allows XSS via component.name...

CVE-2021-42053

The Unicorn framework through 0.35.3 for Django allows XSS via component.name...

Cross site scripting

The Unicorn framework through 0.35.3 for Django allows XSS via component.name...

PYSEC-2021-357

The Unicorn framework through 0.35.3 for Django allows XSS via component.name...

PYSEC-2021-357

The Unicorn framework through 0.35.3 for Django allows XSS via component.name...

CVE-2021-42053

The Unicorn framework through 0.35.3 for Django allows XSS via component.name...

CVE-2021-42053

The connected advisories confirm CVE-2021-42053 concerns the Unicorn framework for Django, with XSS via component.name in versions up to 0.35.3. Root cause is an incomplete fix; an updated fix is needed to address this vulnerability. The related entries (GHSA/OSV) indicate that versions before 0....

Django 跨站脚本漏洞

Django is the Django Foundation's set of open source web application framework based on the Python language. The framework includes an object-oriented mapper, view system, template system, etc. Django's Unicorn framework in version 0.35.3 and earlier has a cross-site scripting vulnerability that...

Exploit for SQL Injection in Djangoproject Django

CVE-2021-35042 Django SQL injection bug Question: explore ho...

SQL Injection in Django

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

GHSA-XPFP-F569-Q3P2 SQL Injection in Django

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application...

django: Potential directory-traversal via archive.extract()

A flaw was found in django where thedjango.utils.archive.extract function, used by startapp --template and startproject --template, allowed directory-traversal via an archive with absolute paths or relative paths with dot segments...

django: Potential directory traversal via ``admindocs``

A flaw was found in django. Staff members could use the :mod:django.contrib.admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if and only if the default admindocs templates have been customized by the developers to also expose the file contents, then not...

django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

A flaw was found in django. Leading zeros in octal literals aren't prohibited in IP addresses. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. The highest threat from this vulnerability is to data integrity...

Security fix for the ALT Linux 10 package python3-module-django version 3.2.6-alt1

3.2.6-alt1 built Sept. 10, 2021 Alexey Shabalin in task 283535 Aug. 18, 2021 Alexey Shabalin - new version 3.2.6 - Rename dbbackend-psycopg2 to dbbackend-postgresql - Add dbbackend-oracle package - Fixes for the following security vulnerabilities: + CVE-2021-35042 Potential SQL injection via...

CVE-2021-32831

Total.js framework npm package total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This c...

GHSA-98HV-QFF3-8793 Unrestricted Upload of File with Dangerous Type in django-widgy

Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...

Unrestricted Upload of File with Dangerous Type in django-widgy

Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...

[SECURITY] Fedora 34 Update: python-django-3.1.13-1.fc34

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...