rpm package
suse/python-Django&distro=SUSE Package Hub 12
pkg:rpm/suse/python-Django&distro=SUSE%20Package%20Hub%2012
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-14574 | Med | 6.1 | < 1.11.15-11.1 | 1.11.15-11.1 | Aug 3, 2018 | django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. | |
| CVE-2018-7537 | Med | 5.3 | < 1.11.11-8.1 | 1.11.11-8.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking | |
| CVE-2018-7536 | Med | 5.3 | < 1.11.11-8.1 | 1.11.11-8.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr | |
| CVE-2018-6188 | Hig | 7.5 | < 1.11.10-5.1 | 1.11.10-5.1 | Feb 5, 2018 | django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user a | |
| CVE-2017-12794 | Med | 6.1 | < 1.11.10-5.1 | 1.11.10-5.1 | Sep 7, 2017 | In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si | |
| CVE-2017-7234 | Med | 6.1 | < 1.11.10-5.1 | 1.11.10-5.1 | Apr 4, 2017 | A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. | |
| CVE-2017-7233 | Med | 6.1 | < 1.11.10-5.1 | 1.11.10-5.1 | Apr 4, 2017 | Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh |
- affected < 1.11.15-11.1fixed 1.11.15-11.1
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
- affected < 1.11.11-8.1fixed 1.11.11-8.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking
- affected < 1.11.11-8.1fixed 1.11.11-8.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr
- affected < 1.11.10-5.1fixed 1.11.10-5.1
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user a
- affected < 1.11.10-5.1fixed 1.11.10-5.1
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si
- affected < 1.11.10-5.1fixed 1.11.10-5.1
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
- affected < 1.11.10-5.1fixed 1.11.10-5.1
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh