rpm package
suse/python-Django&distro=SUSE Enterprise Storage 5
pkg:rpm/suse/python-Django&distro=SUSE%20Enterprise%20Storage%205
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-13596 | — | < 1.6.11-6.13.1 | 1.6.11-6.13.1 | Jun 3, 2020 | An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack. | ||
| CVE-2019-12781 | — | < 1.6.11-6.10.1 | 1.6.11-6.10.1 | Jul 1, 2019 | An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, djang | ||
| CVE-2019-3498 | — | < 1.6.11-6.10.1 | 1.6.11-6.10.1 | Jan 9, 2019 | In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a use | ||
| CVE-2018-7537 | — | < 1.6.11-6.5.1 | 1.6.11-6.5.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking | ||
| CVE-2018-7536 | — | < 1.6.11-6.5.1 | 1.6.11-6.5.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr | ||
| CVE-2016-2512 | Hig | 7.4 | < 1.6.11-6.5.1 | 1.6.11-6.5.1 | Apr 8, 2016 | The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as de |
- CVE-2020-13596Jun 3, 2020affected < 1.6.11-6.13.1fixed 1.6.11-6.13.1
An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
- CVE-2019-12781Jul 1, 2019affected < 1.6.11-6.10.1fixed 1.6.11-6.10.1
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, djang
- CVE-2019-3498Jan 9, 2019affected < 1.6.11-6.10.1fixed 1.6.11-6.10.1
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a use
- CVE-2018-7537Mar 9, 2018affected < 1.6.11-6.5.1fixed 1.6.11-6.5.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking
- CVE-2018-7536Mar 9, 2018affected < 1.6.11-6.5.1fixed 1.6.11-6.5.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr
- affected < 1.6.11-6.5.1fixed 1.6.11-6.5.1
The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as de