openSUSE 15 Security Update : python-Django (openSUSE-SU-2023:0310-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0310-1 advisory. - Denial-of-service possibility in django.utils.text.Truncator fedora-all CVE-2023-43665 Note that Nessus has not tested for this issue but has instead...

CVE-2021-46898: URL Redirection to Untrusted Site

views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...

CVE-2021-46898

views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...

CVE-2021-46898

views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...

django-filebrowser (3.13.2), geonode (3.3.3) +2 more potentially affected by CVE-2021-46898 via django-grappelli (>=2.10.1, <=2.15.1)

django-grappelli PYPI version =2.10.1, =6.5.0, =1.12.1, =1.13.0.dev10 Source cves: CVE-2021-46898 Source advisory: MEND:CVE-2021-46898...

PT-2023-12618 · Unknown · Django-Grappelli

Name of the Vulnerable Software and Affected Versions: django-grappelli versions prior to 2.15.2 Description: The issue arises from the views/switch.py file in django-grappelli, which attempts to prevent external redirection by checking if a URL starts with /. However, this approach does not...

CVE-2021-46898

CVE-2021-46898 – django-grappelli protocol-relative URL redirect issue Affected component: views/switch.py in django-grappelli (also known as Django Grappelli) prior to version 2.15.2. The vulnerability arises from an approach that attempts to block external redirects using a startswith("/") chec...

Django Grappelli Input Validation Error Vulnerability

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in django-grappelli Django Grappelli prior to version 2.15.2, whi...

CVE-2021-46898

views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...

Security update for python-Django (moderate)

openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2023:0310-1 Rating: moderate References: 1215978 Cross-References: CVE-2023-43665 CVSS scores: CVE-2023-43665 SUSE: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports...

Security update for python-Django (moderate)

openSUSE Security Update: Security update for python-Django Announcement ID: openSUSE-SU-2023:0309-1 Rating: moderate References: 1215978 Cross-References: CVE-2023-43665 CVSS scores: CVE-2023-43665 SUSE: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports...

OPENSUSE-SU-2023:0310-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-43665: Denial-of-service in django.utils.text.Truncator boo1215978...

OPENSUSE-SU-2023:0309-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2023-43665: Denial-of-service in django.utils.text.Truncator boo1215978...

CVE-2023-45809

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

coop (2.15.1), django-oscar-elasticsearch (>=2.0.3, <=2.0.7) +18 more potentially affected by CVE-2023-45809 via wagtail (2.15.6)

wagtail PYPI version 2.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop 2.15.1 - django-oscar-elasticsearch =2.0.3, =0.0.1, =0.1.0, =0.9.5, =0.2.0, =0.0.1, =1.2.0, =1.2.1 - wagtail-trash 0.2.0 and more Source cve...

django-oscar-wagtail (0.0.5) potentially affected by CVE-2023-45809 via wagtail (1.6.0rc1)

wagtail PYPI version 1.6.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - django-oscar-wagtail 0.0.5 Source cves: CVE-2023-45809 Source advisory: OSV:PYSEC-2023-219...

Design/Logic Flaw

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

CVE-2023-45809 Disclosure of user names via admin bulk action views in wagtail

Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any change...

CVE-2023-45809

Vulnerability: Wagtail CMS (Django) exposes display names of user accounts via the admin bulk actions view when accessed by a limited-permission editor. Root cause: error messages disclose user display names; by tweaking URL parameters, a non-changeing editor can retrieve any user’s display name....