Debian: Security Advisory (DSA-4598-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 4598-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4598-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 07, 2020 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4598-1] python-django security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4598-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 07, 2020 https://www.debian.org/security/faq -...

CVE-2019-19844

A flaw was found in Django where it did not sanitize the email input from the password recovery form. An attacker with the knowledge of the victim user’s email address could use this flaw to reset the victim user’s password and retrieve the reset link to gain access and take over their account...

DSA-4598-1 python-django - security update

Bulletin has no description...

CVE-2012-5474

The file /etc/openstack-dashboard/localsettings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release python-django-horizon package before 2012.1.1 is world readable and exposes the secret key value...

Design/Logic Flaw

The file /etc/openstack-dashboard/localsettings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release python-django-horizon package before 2012.1.1 is world readable and exposes the secret key value...

CVE-2012-5474

Affected software : Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1). Vulnerability : the file /etc/openstack-dashboard/local_settings is world readable, exposing the secret key value. Impact (as described) : exposure of secret key information;...

CVE-2012-5474

The file /etc/openstack-dashboard/localsettings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release python-django-horizon package before 2012.1.1 is world readable and exposes the secret key value...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django

djangocve201919844poc PoC for CVE-2019-19844https://www...

Django 3.0 2.2 1.11 - Account Hijack

Django 3.0 2.2 1.11 - Account Hijack EDB Note Download: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47879.zip djangocve201919844poc PoC for CVE-2019-19844 Requirements - Python 3.7.x - PostgreSQL 9.5 or higher Setup 1. Create databasee.g. djangocve201919844p...

Django < 3.0 < 2.2 < 1.11 - Account Hijack

EDB Note Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47879.zip djangocve201919844poc PoC for CVE-2019-19844 Requirements - Python 3.7.x - PostgreSQL 9.5 or higher Setup 1. Create databasee.g. djangocve201919844poc 1. Set the database name to the...

Django < 3.0 < 2.2 < 1.11 - Account Hijack Vulnerability

Exploit for python platform in category web applications Django from django.contrib.auth import getusermodel User = getusermodel User.objects.createuser'mike123', 'email protected', 'test123' Procedure For Reproducing 1. Run ./manage.py runserver 1. Open...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Djangoproject Django

djangocve201919844poc PoC for CVE-2019-19844https://www...

Insecure Password Reset

Django uses an insecure password reset mechanism. A remote attacker is able to inject into the password reset form, a malicious email address containing a case transformation of Unicode characters that is equal to the existing user's email address, which will result in the application sending the...

[SECURITY] Fedora 31 Update: python-django-2.2.8-1.fc31

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

USN-4224-1 python-django vulnerability

Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts...

USN-4224-1: Django vulnerability

Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain password reset tokens and hijack accounts...

Ubuntu 16.04 LTS / 18.04 LTS : Django vulnerability (USN-4224-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4224-1 advisory. Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive query to retrieve accounts associated with a...

Debian DLA-2042-1 : python-django security update

It was discovered that there was a potential account hijack vulnerabilility in Django, the Python-based web development framework. Django's password-reset form used a case-insensitive query to retrieve accounts matching the email address requesting the password reset. Because this typically...