admin-extra-urls (0.7.0), autogenerated-api (>=1.0.2, <=1.1.15) +74 more potentially affected by CVE-2016-7401 via django (>=1.5.12, <=1.8.14)

django PYPI version =1.5.12, =1.0.2, =0.1.7, =3.1.0, =0.0.1, =0.1.17, =1.0.0, =0.3.2, =0.1.0, =0.3.0 - django-bower-cache 0.5.0 and more Source cves: CVE-2016-7401 Source advisory: OSV:GHSA-CRHM-QPJC-CM64...

django-buckets (>=0.1.1, <=0.1.5), django-informixdb (>=0.1.2, <=0.1.3) +7 more potentially affected by CVE-2016-7401 via django (>=1.9.0, <=1.9.6)

django PYPI version =1.9.0, =0.1.1, =0.1.2, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - goshstore 0.3.0 - kwikapi-django 0.0.1 - planadversity 1.0.2 Source cves: CVE-2016-7401 Source advisory: GHSA-CRHM-QPJC-CM64...

Django CSRF Protection Bypass

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

GHSA-RM2J-X595-Q9CJ Django Vulnerable to Cache Poisoning

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...

Django Vulnerable to Cache Poisoning

Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request...

GHSA-WXG3-MFPH-QG9W Django Might Allow CSRF Requests via URL Verification

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

Django Might Allow CSRF Requests via URL Verification

The verifyexists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitra...

GHSA-QH9X-MC42-VG4G django-anymail Includes Sensitive Information in Log Files

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...

django-anymail Includes Sensitive Information in Log Files

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...

GHSA-QGVW-QC2Q-GV5Q Django Tastypie Improper Deserialization of YAML Data

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

Django Tastypie Improper Deserialization of YAML Data

The fromyaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method...

Django Cross-site scripting Vulnerability

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

admin-extra-urls (0.7.0), backstage-oauth2 (>=0.1.7, <=0.1.8) +73 more potentially affected by CVE-2016-6186 via django (>=1.5.12, <=1.8.13)

django PYPI version =1.5.12, =0.1.7, =3.1.0, =0.0.1, =0.1.17, =1.0.0, =0.3.2, =0.1.0, =0.3.0 - django-bower-cache 0.5.0 - django-canary-endpoint 0.1.2 and more Source cves: CVE-2016-6186 Source advisory: OSV:GHSA-C8C8-9472-W52H...

django-buckets (>=0.1.1, <=0.1.5), django-informixdb (>=0.1.2, <=0.1.3) +7 more potentially affected by CVE-2016-6186 via django (>=1.9.0, <=1.9.6)

django PYPI version =1.9.0, =0.1.1, =0.1.2, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - goshstore 0.3.0 - kwikapi-django 0.0.1 - planadversity 1.0.2 Source cves: CVE-2016-6186 Source advisory: GHSA-C8C8-9472-W52H...

GHSA-C8C8-9472-W52H Django Cross-site scripting Vulnerability

Cross-site scripting XSS vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors...

django-buckets (>=0.1.1, <=0.1.5), django-informixdb (>=0.1.2, <=0.1.3) +7 more potentially affected by CVE-2016-6186 via django (>=1.9.0, <=1.9.6)

django PYPI version =1.9.0, =0.1.1, =0.1.2, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - goshstore 0.3.0 - kwikapi-django 0.0.1 - planadversity 1.0.2 Source cves: CVE-2016-6186 Source advisory: OSV:GHSA-C8C8-9472-W52H...

Django Allows Open Redirects

The django.util.http.issafeurl function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."...

GHSA-VQ3H-3Q7V-9PRW Django Allows Open Redirects

The django.util.http.issafeurl function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\djangoproject.com."...

salmon (0.2.0) potentially affected by CVE-2014-3730 via django (1.6.1)

django PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - salmon 0.2.0 Source cves: CVE-2014-3730 Source advisory: GHSA-VQ3H-3Q7V-9PRW...

GHSA-625G-GX8C-XCMG Django Middleware Enables Session Hijacking

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors...