python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

An open-redirect flaw was found in the way Django's django.utils.http.issafeurl function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site...

Moderate: Red Hat Security Advisory: python-django security update

An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 Operational Tools for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

An open-redirect flaw was found in the way Django's django.utils.http.issafeurl function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

An open-redirect flaw was found in the way Django's django.utils.http.issafeurl function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site...

Moderate: Red Hat Security Advisory: python-django security update

An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 Kilo for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

An open-redirect flaw was found in the way Django's django.utils.http.issafeurl function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site...

Moderate: Red Hat Security Advisory: python-django security update

An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 6.0 Juno for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth

An open-redirect flaw was found in the way Django's django.utils.http.issafeurl function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site...

Moderate: Red Hat Security Advisory: python-django security update

An update for python-django is now available for Red Hat Enterprise Linux OpenStack Platform 5.0 Icehouse for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

python-django: User enumeration through timing difference on password hasher work factor upgrade

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login...

Fedora Update for python-django FEDORA-2016-11183

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : python-django-1.8.11-1.fc22 (2016-b004d6d8f7)

fix regression in 1.8.10 ---- update to 1.8.10, fixing CVE-2016-2512, CVE-2016-2513 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 23 : python-django-1.8.11-1.fc23 (2016-11183ea08d)

fix regression in 1.8.10 ---- update to 1.8.10, fixing CVE-2016-2512, CVE-2016-2513 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

[SECURITY] Fedora 22 Update: python-django-1.8.11-1.fc22

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 23 Update: python-django-1.8.11-1.fc23

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Gratipay: csrf_token cookie don't have the flag "HttpOnly"

As the researcher @kuskumar pointed out, the cookie csrftoken doesn't have the HttpOnly flag. While it is often seen as bad practice to leave cookies without this flag since they are likely to be stolen via XSS, our session cookie has this flag set, making impersonation harder. Regarding csrftoke...

The vulnerability of the Django web application software platform allows attackers to circumvent existing access restrictions.

The vulnerability of the Django web application framework exists due to incorrect installations of the saveas parameter in the ModelAdmin class. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions from a remote perspective...