91 matches found
CVE-2024-34078 html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization
html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...
CVE-2024-34078 html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization
html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...
CVE-2024-34078
html-sanitizer is an allowlist-based HTML cleaner. If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. The problem has...
Arbitrary HTML present after sanitization because of unicode normalization
Impact If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. Patches The problem has been fixed in 2.4.2. Workarounds Se...
GHSA-WVHX-Q427-FGH3 Arbitrary HTML present after sanitization because of unicode normalization
Impact If using keeptypographicwhitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode characters normalize to chevrons; this allows specially crafted HTML to escape sanitization. Patches The problem has been fixed in 2.4.2. Workarounds Se...
PT-2024-25688
Name of the Vulnerable Software and Affected Versions html-sanitizer versions prior to 2.4.2 Description The issue concerns an allowlist-based HTML cleaner. If using keep typographic whitespace=False which is the default, the sanitizer normalizes unicode to the NFKC form at the end. Some unicode...
RHEL 6 / 7 : rh-python36-python (RHSA-2019:0765)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0765 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...
RHEL 6 / 7 : python27-python (RHSA-2019:0806)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0806 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...
BIT-DJANGO-2023-46695
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS denial of service attack via certain inputs with a very large number of...
Rocky Linux 8 : python27:2.7 (RLSA-2019:0981)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:0981 advisory. - SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter. CVE-2019-7164 - SQLAlchemy 1.2.17 has SQL Injectio...
Django < 3.2.23, 4.1.x < 4.1.13, 4.2.x < 4.2.7 DoS Vulnerability - Windows
Django is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; ...
Denial Of Service (DoS)
Django is vulnerable to Denial Of Service DoS. The vulnerability exists in the topython functionality within the UsernameField class of forms.py. It fails to implement a maximum length check for the NFKC normalization, which allows an attacker to potentially crash the application on Windows by...
Django potential denial of service vulnerability in UsernameField on Windows
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS denial of service attack via certain inputs with a very large number of...
CVE-2023-46695
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS denial of service attack via certain inputs with a very large number of...
Code injection
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS denial of service attack via certain inputs with a very large number of...
PYSEC-2023-222
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS denial of service attack via certain inputs with a very large number of...
PYSEC-2023-222
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS denial of service attack via certain inputs with a very large number of...
CVE-2023-46695
CVE-2023-46695 affects Django 3.2 < 3.2.23, 4.1 < 4.1.13, and 4.2
CVE-2023-46695
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS denial of service attack via certain inputs with a very large number of...
PT-2023-7674 · Django +2 · Django +2
Name of the Vulnerable Software and Affected Versions: Django versions 3.2 before 3.2.23 Django versions 4.1 before 4.1.13 Django versions 4.2 before 4.2.7 Description: The issue is related to the NFKC normalization being slow on Windows, which can lead to a potential denial of service DoS attack...