Ubuntu 16.04 ESM : Django vulnerability (USN-6054-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6054-2 advisory. USN-6054-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...

NetBox cross-site scripting vulnerabilities

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in NetBox version v3.5.1, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows...

tendenci (>=14.0.3, <=14.4.0) potentially affected by CVE-2023-33185 via django-ses (2.2.0)

django-ses PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-ses and may be impacted: - tendenci =14.0.3, =14.4.0 Source cves: CVE-2023-33185 Source advisory: OSV:GHSA-QG36-9JXH-FJ25...

GHSA-QG36-9JXH-FJ25 Incorrect signature verification in django-ses

The djangoses library implements a mail backend for Django using AWS Simple Email Service. The library exports the SESEventWebhookView class intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by djangoses,...

tendenci (>=11.0.0, <=11.3.1) potentially affected by CVE-2023-33185 via django-ses (0.7.1)

django-ses PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-ses and may be impacted: - tendenci =11.0.0, =11.3.1 Source cves: CVE-2023-33185 Source advisory: OSV:GHSA-QG36-9JXH-FJ25...

tendenci (>=11.4.0, <=11.4.9) potentially affected by CVE-2023-33185 via django-ses (0.8.12)

django-ses PYPI version 0.8.12 is affected by a known vulnerability. The following packages have a transitive dependency on django-ses and may be impacted: - tendenci =11.4.0, =11.4.9 Source cves: CVE-2023-33185 Source advisory: OSV:GHSA-QG36-9JXH-FJ25...

django-ses-sns-tracker (1.1.5) potentially affected by CVE-2023-33185 via django-ses (1.0.3)

django-ses PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on django-ses and may be impacted: - django-ses-sns-tracker 1.1.5 Source cves: CVE-2023-33185 Source advisory: OSV:GHSA-QG36-9JXH-FJ25...

speedpycom (0.1.5) potentially affected by CVE-2023-33185 via django-ses (2.6.1)

django-ses PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-ses and may be impacted: - speedpycom 0.1.5 Source cves: CVE-2023-33185 Source advisory: OSV:GHSA-QG36-9JXH-FJ25...

GHSA-X7C2-7WVG-JPX7 kiwitcms vulnerable to stored XSS via unrestricted files upload

Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded, see GHSA-fwcf-753v-fgcj and Content-Security-Policy definition to prevent...

PT-2023-24202 · Unknown · Django-Ses

Name of the Vulnerable Software and Affected Versions: Django-SES versions prior to 3.5.0 Description: The django ses library, a mail backend for Django using AWS Simple Email Service, has a flaw in the verification of signed requests from AWS. The SESEventWebhookView class is intended to handle...

PT-2023-23961

Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 12.3 Description The issue arises from insufficient upload validation checks in Kiwi TCMS, allowing an attacker to upload potentially dangerous files. These files can be combined to circumvent the existing...

Malicious code in print-django (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 078a5d3998b66f598078a8a6af58420b3dc0685a8c48e4e4b4fb7856496c5a24 The OpenSSF Package Analysis project identified 'print-django' @ 3.9.10 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1387 Malicious code in print-django (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 078a5d3998b66f598078a8a6af58420b3dc0685a8c48e4e4b4fb7856496c5a24 The OpenSSF Package Analysis project identified 'print-django' @ 3.9.10 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1362 Malicious code in django-pyyaml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 07b95436e2a145afcd7f459f6101c1d1b699d4d5842126d920fe77f700c8899b The OpenSSF Package Analysis project identified 'django-pyyaml' @ 20.17.15 pypi as malicious. It is considered malicious because: - The package...

Malicious code in django-pyyaml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 07b95436e2a145afcd7f459f6101c1d1b699d4d5842126d920fe77f700c8899b The OpenSSF Package Analysis project identified 'django-pyyaml' @ 20.17.15 pypi as malicious. It is considered malicious because: - The package...

SUSE CVE-2023-31047

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField only the last uploaded file was validated. However,...

OESA-2023-1286 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has...

Mageia: Security Advisory (MGASA-2023-0165)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2023-0165 Updated python-django packages fix security vulnerability

Passing certain inputs e.g., an excessive number of parts to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. CVE-2023-24580 Bypass of validation when using one form field to upload multiple files. This...

Updated python-django packages fix security vulnerability

Passing certain inputs e.g., an excessive number of parts to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. CVE-2023-24580 Bypass of validation when using one form field to upload multiple files. This...