CVE-2016-7401

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

CVE-2016-7401

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

Django CSRF Bypass (CVE-2016-7401)

Author: p0wd3r 知道创宇404安全实验室 Date: 2016-09-28 0x00 漏洞概述 1.漏洞简介 Django是一个由Python写成的开源Web应用框架。在两年前有研究人员在hackerone上提交了一个利用Google Analytics来绕过Django的CSRF防护机制的漏洞CSRF protection bypass on any Django powered site via Google Analytics，通过该漏洞，当一个网站使用了Django作为Web框架并且设置了Django的CSRF防护机制，同时又使用了Google...

CVE-2 0 1 6-7 4 0 1-Django CSRF Defense bypass vulnerability analysis-vulnerability warning-the black bar safety net

Django yesterday fixes this vulnerability: https://www.djangoproject.com/weblog/2016/sep/26/security-releases/ In fact, last year had similar issues, report it to Twitter https://hackerone.com/reports/14883 that vulnerability is composed of the following components. 0x01 by the Google Analytics...

FreeBSD : django -- CSRF protection bypass on a site with Google Analytics (bb022643-84fb-11e6-a4a1-60a44ce6887b)

Django Software Foundation reports : An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

USN-3089-1 python-django vulnerability

Sergey Bobrov discovered that Django incorrectly parsed cookies when being used with Google Analytics. A remote attacker could possibly use this issue to set arbitrary cookies leading to a CSRF protection bypass...

USN-3089-1: Django vulnerability

Sergey Bobrov discovered that Django incorrectly parsed cookies when being used with Google Analytics. A remote attacker could possibly use this issue to set arbitrary cookies leading to a CSRF protection bypass...

CVE-2016-7401

A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. In this update, the parser for ''request.COOKIES'' has been simplified to better match browser behavi...

Debian DSA-3678-1 : python-django - security update

Sergey Bobrov discovered that cookie parsing in Django and Google Analytics interacted such a way that an attacker could set arbitrary cookies. This allows other malicious websites to bypass the Cross-Site Request Forgery CSRF protections built into Django. %NASLMINLEVEL 70300 C Tenable Network...

CVE-2016-7401

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

UBUNTU-CVE-2016-7401

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies...

PT-2016-7312

Name of the Vulnerable Software and Affected Versions Django versions prior to 1.8.15 Django versions 1.9.x prior to 1.9.10 Description The issue allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies, specifically when used on a site with Google...

DSA-3678-1 python-django - security update

Bulletin has no description...

django -- CSRF protection bypass on a site with Google Analytics

Django Software Foundation reports: An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection...

Debian: Security Advisory (DSA-3678-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 23 : drupal7-google_analytics (2016-a3cc693fba)

7.x-2.3 - Google Analytics - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-042 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

[SECURITY] Fedora 23 Update: drupal7-google_analytics-2.3-1.fc23

Adds the Google Analytics web statistics tracking system to your website. This package provides the following Drupal module: googleanalytics...

[SECURITY] Fedora 25 Update: drupal7-google_analytics-2.3-1.fc25

Adds the Google Analytics web statistics tracking system to your website. This package provides the following Drupal module: googleanalytics...

Drupal Google Analytics Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Google Analytics is one of the web traffic analysis modules. A cross-site scripting vulnerability in the Drupal Google Analytics module in versions 7.x-2.x prior to 7.x-2.3 and 8.x-2.x...

Google Analytics - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-042

This module enables you to add integration with Google Analytics statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is...