7635 matches found
Django has an unspecified vulnerability (CNVD-2021-68758)
Django is the Django Foundation's set of Python-based language open source Web application framework . Django-Widgy version 0.8.4 contains a security vulnerability that can be exploited by remote attackers to execute arbitrary code via the "image" widget in the component "Change Widgy Page"...
Fedora: Security Advisory for python-django (FEDORA-2021-78e501d62a)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2020-18704
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...
CVE-2020-18704
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...
Unrestricted file upload
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...
PYSEC-2021-336
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...
PYSEC-2021-336
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...
CVE-2020-18704
CVE-2020-18704 affects Django-Widgy v0.8.4 . The issue is an unrestricted upload of a file with a dangerous type via the image widget in the component “Change Widgy Page” , which can allow remote attackers to execute arbitrary code. The provided documents do not include specific exploitation deta...
Django 代码问题漏洞
Django is the Django Foundation's set of Python-based language open source Web application framework . Django-Widgy version 0.8.4 contains a security vulnerability that can be exploited by remote attackers to execute arbitrary code via the "image" widget in the component "Change Widgy Page"...
SUSE-SU-2021:2554-1 Security update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema
This update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2,...
Django SQL Injection
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break characte...
The vulnerability of the django.utils.archive.extract method in the Django framework, related to deficiencies in pathname restrictions for directories, allows attackers to compromise data integrity.
The vulnerability of the django.utils.archive.extract method in the Django framework is related to shortcomings in pathname restrictions. Exploiting this vulnerability could allow an attacker to compromise data integrity...
The vulnerability of the contrib.postgres.aggregates.StringAgg component in the Django web application framework allows a hacker to access confidential data, compromise its integrity, and cause service failures due to improper handling of SQL queries.
The vulnerability of the contrib.postgres.aggregates.StringAgg component in the Django web application framework is related to the lack of measures to protect the structure of web pages. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its...
Updated python-django package fixes security vulnerabilities
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability CVE-2021-28658. In Django 2.2 before 2.2.21, 3.1 before 3.1.9, an...
MGASA-2021-0356 Updated python-django package fixes security vulnerabilities
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability CVE-2021-28658. In Django 2.2 before 2.2.21, 3.1 before 3.1.9, an...
The vulnerability of the QuerySet.order_by() function in the Django web application framework allows a hacker to execute arbitrary commands.
The vulnerability of the QuerySet.orderby function in the Django web application framework relates to the lack of security measures for handling SQL queries. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...
Security fix for the ALT Linux 9 package python3-module-django version 2.2.24-alt1
July 13, 2021 Alexey Shabalin 2.2.24-alt1 - new version 2.2.24 - Fixes for the following security vulnerabilities: + CVE-2021-28658 Potential directory-traversal via uploaded files + CVE-2021-31542 Potential directory-traversal via uploaded files + CVE-2021-32052 Header injection possibility sinc...
Security fix for the ALT Linux 10 package python3-module-django version 2.2.24-alt1
July 13, 2021 Alexey Shabalin 2.2.24-alt1 - new version 2.2.24 - Fixes for the following security vulnerabilities: + CVE-2021-28658 Potential directory-traversal via uploaded files + CVE-2021-31542 Potential directory-traversal via uploaded files + CVE-2021-32052 Header injection possibility sinc...
