CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

Django Access Restriction Bypass

The vulnerability of the Django web application framework exists due to incorrect installations of the saveas parameter in the ModelAdmin class. Exploiting this vulnerability allows a malicious actor to circumvent existing access restrictions from a remote perspective...

python-django: permission bypass

If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...

django -- regression in permissions model

Tim Graham reports: User with "change" but not "add" permission can create objects for ModelAdmin’s with saveas=True...