10791 matches found
Mezzanine 4.1.0 Cross Site Scripting
Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MEZZANINE-CMS-XSS.txt Vendor: =================== mezzanine.jupo.org Product: ================ Mezzanine 4.1.0 Mezzanine is an open source CMS built using the python based Django framework...
Mail.ru: [touch.lady.mail.ru] CRLF Injection
PoC: https://touch.lady.mail.ru/%0aSet-Cookie:csrftoken=x;domain=.mail.ru; HTTP Response: HTTP/1.1 301 Moved Permanently ... Location: https://lady.mail.ru/ Set-Cookie:csrftoken=x;domain=.mail.ru; Уязвимость может быть использована для обхода CSRF защиты Django сайтов или для эксплуатации XSS чер...
python-django: permission bypass
If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...
python2-django: permission bypass
If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...
SUSE-SU-2016:0044-1 Security update for python-Django
This update fixes the following security issues: - bnc955412, CVE-2015-8213 Possible settings leak in date template filter - bnc937522, CVE-2015-5143 Possible denial-of-service in session store - bnc937523, CVE-2015-5144 Possible Header injection - bnc941587, CVE-2015-5963 Possible...
SUSE-SU-2016:0040-1 Security update for python-Django
This update for python-Django fixes the following issues: - Prevent settings leak in date template filter. bsc955412, CVE-2015-8213...
[SECURITY] Fedora 22 Update: python-django-1.8.7-1.fc22
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
Fedora Update for python-django FEDORA-2015-323274
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE-SU-2015:2327-1 Security update for python-Django
This update for python-Django fixes the following issues: - Add 0004-1.6.x-fixed-a-settings-leak-possibility-in-the-date-.patch to prevent settings leak in date template filter bsc955412, CVE-2015-8213...
openSUSE Security Update : python-django (openSUSE-2015-860)
The python-django package was updated to fix the following security issue : - CVE-2015-8213: Fixed a problem to prevent settings leak in date template filter bnc955412 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
openSUSE Security Update : python-Django (openSUSE-2015-862)
The python-Django package was updated to fix the following security issue : - CVE-2015-8213: Fixed a problem to prevent settings leak in date template filter bnc955412. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
Mageia: Security Advisory (MGASA-2015-0463)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2015-8213
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
DEBIAN-CVE-2015-8213
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
CVE-2015-8213
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
PYSEC-2015-11
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
PYSEC-2015-11
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
Format string
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...
[SECURITY] Fedora 23 Update: python-django-1.8.7-1.fc23
Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...
CVE-2015-8213
The getformat function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRETKEY...