dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2024-22190 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2024-22190 Source advisory: OSV:GHSA-2MQJ-M65W-JGHX...

Django -- multiple vulnerabilities

Django reports: CVE-2024-24680:Potential denial-of-service in intcomma template filter...

django-saas-email (>=0.1.21, <=0.1.29), geonode (3.3.3) +4 more potentially affected by CVE-2024-21910 via django-tinymce (>=1.5.1b4, <=3.3.0)

django-tinymce PYPI version =1.5.1b4, =0.1.21, =0.1.3.2, =0.3.0, =0.5.2 - zinnia-wysiwyg-tinymce 1.4.0 Source cves: CVE-2024-21910 Source advisory: MEND:CVE-2024-21910...

Django Uncontrolled Resource Consumption DoS

The vulnerability of the Django web application framework is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Django Data Compromise Check Missing

The vulnerability of the Django web application framework lies in the fact that code is loaded without any checks for its integrity. Exploiting this vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause service failures...

Django uri_to_iri DoS

The vulnerability of the django.utils.encoding.uritoiri component in the Django web application framework is related to an improper check on the number of data inputs. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Django Regular Expression DoS

The vulnerability of the Django web application framework is related to insufficient processing of regular expressions. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2023-51649

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

Code injection

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

PYSEC-2023-287

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

CVE-2023-51649 Nautobot missing object-level permissions enforcement when running Job Buttons

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

CVE-2023-51649

CVE-2023-51649 affects Nautobot, a Django-based network automation platform. The issue: when submitting a Job via a Job Button, only the model-level extras.run_job permission is enforced; object-level permissions (permission to run a specific Job) are not checked by the relevant URL/view. Result:...

CVE-2023-51649: Incorrect Authorization

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have...

Django Denial-of-Service

The vulnerability of the Django web application framework is related to unlimited resource distribution. Exploiting this vulnerability can allow a malicious actor to trigger a Denial-of-Service attack remotely...

Unauthenticated db-file-storage views

Impact In Nautobot 1.x and 2.0.x, the URLs /files/get/?name=... and /files/download/?name=... are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job...

CVE-2023-50263

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...

PYSEC-2023-286

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...

CVE-2023-50263 Nautobot allows unauthenticated db-file-storage views

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...

CVE-2023-50263

CVE-2023-50263 (Nautobot) describes an information disclosure vulnerability where unauthenticated access to file storage URLs /files/get/?name=… and /files/download/?name=… is possible in Nautobot 1.x and 2.0.x before 1.6.7 and 2.0.6. The issue stems from the default Django-db-file-storage implem...

CVE-2023-50263 Nautobot allows unauthenticated db-file-storage views

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs /files/get/?name=... and /files/download/?name=... are used to provid...