EUVD-2018-0194

Malware in sbrugna...

GHSA-VFQ6-HQ5R-27R6 Django Potential account hijack via password reset form

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address that is equal to an existing user's email address after case transformation of Unicode characters would allow an attacker to be sent a password reset token for the matched user...