Design/Logic Flaw

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential...

PYSEC-2021-64

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential...

CVE-2020-15225

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential...

UBUNTU-CVE-2020-15225

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential...

PYSEC-2021-64

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential...

Django 安全漏洞

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django-filter versions prior to 2.4.0, which stems from being...

CVE-2020-15225 Denial of Service vulnerability in django-filter

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential...

CVE-2020-15225

django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential...

CVE-2020-15225

CVE-2020-15225 affects django-filter prior to 2.4.0, where automatically generated NumberFilter fields could be exploited via input using exponential formats with large exponents, enabling DoS. The fix in 2.4.0+ adds a MaxValueValidator with default limit_value 1e50 on the NumberFilter form field...

Security update for python-django-registration (moderate)

openSUSE Security Update: Security update for python-django-registration Announcement ID: openSUSE-SU-2021:0597-1 Rating: moderate References: 1184427 Cross-References: CVE-2021-21416 Affected Products: openSUSE Backports SLE-15-SP2 An update that fixes one vulnerability is now available...

OPENSUSE-SU-2021:0597-1 Security update for python-django-registration

This update for python-django-registration fixes the following issues: Update to 3.1.2 boo1184427, CVE-2021-21416 Filter sensitive POST parameters in error reports Fix RemovedInDjango40Warning from Signal arguments This update was imported from the openSUSE:Leap:15.2:Update update project...

Django -- multiple vulnerabilities

Django Release reports: CVE-2021-31542:Potential directory-traversal via uploaded files. MultiPartParser, UploadedFile, and FieldFile allowed directory-traversal via uploaded files with suitably crafted file names...

django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle

A SQL-injection flaw was found in python-django, where GIS functions and aggregates in Oracle did not correctly neutralize tolerance-parameter data. A remote attacker could use this flaw to submit crafted data to inject malicious SQL...

openSUSE: Security Advisory for python-django-registration (openSUSE-SU-2021:0588-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Code injection

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

PYSEC-2021-114

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

CVE-2021-29434

Wagtail (a Django-based CMS) has a vulnerability in rich-text links where server-side checks do not enforce a valid protocol, allowing a malicious admin user to publish content containing javascript: URLs. Affected versions can be exploited via admin POST requests; an ordinary site visitor cannot...

CVE-2021-29434 Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could...

OPENSUSE-SU-2021:0588-1 Security update for python-django-registration

This update for python-django-registration fixes the following issues: Update to 3.1.2 boo1184427, CVE-2021-21416 Filter sensitive POST parameters in error reports Fix RemovedInDjango40Warning from Signal arguments...

Security update for python-django-registration (moderate)

openSUSE Security Update: Security update for python-django-registration Announcement ID: openSUSE-SU-2021:0588-1 Rating: moderate References: 1184427 Cross-References: CVE-2021-21416 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This...