Django 代码问题漏洞

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. Django suffers from a code issue vulnerability that stems from the authenticator accepting leadin...

Ubuntu 18.04 LTS / 20.04 LTS : Django vulnerabilities (USN-4975-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4975-1 advisory. It was discovered that the Django URLValidator function incorrectly handled newlines and tabs. A remote attacker could possibly use this issu...

PT-2021-4521

Name of the Vulnerable Software and Affected Versions Django versions 2.2 before 2.2.24 Django versions 3.x before 3.1.12 Django versions 3.2 before 3.2.4 Description The issue is related to the URLValidator, validate ipv4 address, and validate ipv46 address functions in Django, which do not...

PT-2021-4574

Name of the Vulnerable Software and Affected Versions Django versions 2.2.23 and earlier, 3.x versions prior to 3.1.12, 3.2.x versions prior to 3.2.4 Description The issue is related to a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView vi...

openSUSE Security Update : python-django-registration (openSUSE-2021-588)

This update for python-django-registration fixes the following issues : Update to 3.1.2 boo1184427, CVE-2021-21416 - Filter sensitive POST parameters in error reports - Fix RemovedInDjango40Warning from Signal arguments %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

USN-4932-2 python-django vulnerability

USN-4932-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwri...

USN-4932-2: Django vulnerability

USN-4932-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that Django incorrectly handled certain filenames. A remote attacker could possibly use this issue to create or overwri...

in cythron/tweango

✍️ Description The Django secret key was hard coded in the Github repository which is vulnerable as https://huntr.dev/bounties/1-other-cythron/Tweango/ accordingly. Since the GitHub public API monitor every single git commit that is made, attacker can still find the key from commit lists. = It is...

Fedora: Security Advisory for python-django (FEDORA-2021-01044b8a59)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Ubuntu 16.04 ESM : Django vulnerability (USN-4932-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4932-2 advisory. USN-4932-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...

in cythron/tweango

✍️ Description Django secret key is pushed into Github repository. This is used to sign Json objects, create hashes and generate Csrf tokens. 🕵️‍♂️ Proof of Concept https://stackoverflow.com/questions/15170637/effects-of-changing-djangos-secret-key/15383766?noredirect=1comment2174349415383766 💥...

[SECURITY] Fedora 34 Update: python-django-3.1.9-1.fc34

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

HTTP Response Header Injection

django is vulnerable to HTTP response header injection. The vulnerability exists when the library does not prevent the use of malicious characters such as newlines and tabs in URL when it is used with Python 3.9.5+...

Django 2.2 < 2.2.21, 3.1 < 3.1.9, 3.2 < 3.2.1 Directory Traversal Vulnerability - Windows

Django is prone to a directory traversal vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

Django 2.2 < 2.2.21, 3.1 < 3.1.9, 3.2 < 3.2.1 Directory Traversal Vulnerability - Linux

Django is prone to a directory traversal vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

Django 2.2 < 2.2.22, 3.1 < 3.1.10, 3.2 < 3.2.2 Header Injection Vulnerability - Linux

Django is prone to a header injection vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Django 2.2 < 2.2.22, 3.1 < 3.1.10, 3.2 < 3.2.2 Header Injection Vulnerability - Windows

Django is prone to a header injection vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Debian: Security Advisory (DLA-2651-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2651-1 : python-django security update

It was discovered that there was potential directory-traversal vulnerability in Django, a popular Python-based web development framework. The MultiPartParser, UploadedFile and FieldFile classes allowed directory-traversal via uploaded files with suitably crafted file names. In order to mitigate...

FreeBSD : Django -- multiple vulnerabilities (1766359c-ad6e-11eb-b2a4-080027e50e6d)

Django Release reports : CVE-2021-31542:Potential directory-traversal via uploaded files. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...