debian/python-django vulnerabilities

Latest debian/python-django CVEs

Newest publication first · page 7 of 11

1. DLA-1629-1 python-django - security update

   Published 2019-01-06

   Unknown

2. CVE-2018-16984 Django allows unprivileged users to read the password hashes of arbitrary accounts

   Published 2018-10-02

   Medium·CVSS 4.9 EPSS 2.1%

   An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission...

3. DSA-4264-1 python-django - security update

   Published 2018-08-05

   Unknown

4. CVE-2018-14574 Django open redirect

   Published 2018-08-03

   Medium·CVSS 6.1 EPSS 25.5%

   django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.

5. DSA-4161-1 python-django - security update

   Published 2018-04-01

   Unknown

6. CVE-2018-7537 Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

   Published 2018-03-09

   Medium·CVSS 5.3 EPSS 4.4%

   An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking...

7. CVE-2018-7536 Django denial-of-service possibility in urlize and urlizetrunc template filters

   Published 2018-03-09

   Medium·CVSS 5.3 EPSS 4.6%

   An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr...

8. DLA-1303-1 python-django - security update

   Published 2018-03-08

   Unknown

9. CVE-2018-6188 Django vulnerable to information leakage in AuthenticationForm

   Published 2018-02-05

   High·CVSS 7.5 EPSS 4.8%

   django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user a...

10. CVE-2017-12794 Django vulnerable to XSS on 500 pages

    Published 2017-09-07

    Medium·CVSS 6.1 EPSS 23.6%

    In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si...

11. DSA-3835-1 python-django - security update

    Published 2017-04-26

    Unknown

12. DLA-885-1 python-django - security update

    Published 2017-04-05

    Unknown

13. CVE-2017-7234 Django open redirect

    Published 2017-04-04

    Medium·CVSS 6.1 EPSS 1.8%

    A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the django.views.static.serve() view could redirect to any other domain, aka an open redirect vulnerability.

14. CVE-2017-7233 Django open redirect and possible XSS attack via user-supplied numeric redirect URLs

    Published 2017-04-04

    Medium·CVSS 6.1 EPSS 2.4%

    Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url()) considered some numeric URLs "safe" when they should...

15. CVE-2016-9013 Django user with hardcoded password created when running tests on Oracle

    Published 2016-12-09

    Critical·CVSS 9.8 EPSS 5.1%

    Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging fa...

16. CVE-2016-9014 Django DNS Rebinding Vulnerability

    Published 2016-12-09

    High·CVSS 8.1 EPSS 6.1%

    Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

17. DLA-706-1 python-django - security update

    Published 2016-11-14

    Unknown

18. DLA-649-1 python-django - security update

    Published 2016-10-06

    Unknown

19. CVE-2016-7401 Django CSRF Protection Bypass

    Published 2016-10-03

    High·CVSS 7.5 EPSS 5.7%

    The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

20. DSA-3678-1 python-django - security update

    Published 2016-09-26

    Unknown

21. DLA-590-1 python-django - security update

    Published 2016-08-09

    Unknown

22. CVE-2016-6186 Django Cross-site scripting Vulnerability

    Published 2016-08-05

    Medium·CVSS 6.1 EPSS 5.5% Public exploit

    Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or...

23. DLA-555-1 python-django - security update

    Published 2016-07-21

    Unknown

24. DSA-3622-1 python-django - security update

    Published 2016-07-18

    Unknown

25. CVE-2016-2512 Django XSS Vulnerability

    Published 2016-04-08

    High·CVSS 7.4 EPSS 4.1%

    The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as de...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.