619 matches found
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
GeoDjango Spatial Field DoS
The vulnerability related to spatial field and component search in GeoDjango, a software platform for Django web applications, involves uncontrolled recursion. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...
GeoDjango Spatial Search Code Execution
The spatial search vulnerability in the GeoDjango software platform for Django web applications is related to improper external handling of filenames or file paths. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...
Security update for python-Django (critical)
openSUSE security update: security update for python-django ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22196-1 Rating: critical References: bsc1284471 bsc1284472 bsc1284476 bsc1284481 Cross-References: CVE-2026-77050 CVE-2026-84429 CVE-2026-878...
django: Django: Remote code execution via GeoDjango spatial lookups
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...
On the Performance of AoA-Based Physical-Layer Authentication under Multi-Source Impersonation Attacks
This paper investigates cooperative impersonation attacks against angle-of-arrival AoA-based authentication for a wireless communication receiver equipped with a digital uniform linear array. Specifically, we characterize the vulnerability and robustness of this authentication system in relation ...
OPENSUSE-SU-2026:22196-1 Security update for python-Django
This update for python-Django fixes the following issues: Changes in python-Django: - CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset, without any permission on the targeted object, marking an out-of-queryset object for deletion...
ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-113717 via virtualenv (20.15.1)
virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-113717 Source advisory: OSV:GHSA-CX28-75Q4-X26Q...
ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-113714 via virtualenv (20.15.1)
virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-113714 Source advisory: OSV:GHSA-494P-63J8-28P3...
ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-113718 via virtualenv (20.15.1)
virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-113718 Source advisory: OSV:GHSA-394H-QWMC-48PF...
ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-113720 via virtualenv (20.15.1)
virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-113720 Source advisory: OSV:GHSA-FC2G-4W5P-6WHM...
ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-113723 via virtualenv (20.15.1)
virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-113723 Source advisory: OSV:GHSA-6W3R-XR62-4XCP...
ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-113715 via virtualenv (20.15.1)
virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...
ersilia (>=0.1.0, <=0.1.1), pytoil (0.34.0) +1 more potentially affected by CVE-2026-113719 via virtualenv (20.15.1)
virtualenv PYPI version 20.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ersilia =0.1.0, =0.0.4, =0.0.7 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...
CVE-2026-55465
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...
CVE-2026-55465
The Goobi viewer web application (versions 22.04 to before 26.05 ) is vulnerable to Solr injection via an unauthenticated REST endpoint: GET /api/v1/index/{solrField}/spatial/search. The root cause is the direct concatenation of the user-supplied region query parameter into a Solr query string wi...