rpm package
suse/python-Django&distro=SUSE Package Hub 12 SP1
pkg:rpm/suse/python-Django&distro=SUSE%20Package%20Hub%2012%20SP1
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-24580 | Hig | 7.5 | < 1.11.15-2.1 | 1.11.15-2.1 | Feb 15, 2023 | An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a po | |
| CVE-2018-14574 | Med | 6.1 | < 1.11.15-2.1 | 1.11.15-2.1 | Aug 3, 2018 | django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. | |
| CVE-2018-7537 | Med | 5.3 | < 1.11.15-2.1 | 1.11.15-2.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking | |
| CVE-2018-7536 | Med | 5.3 | < 1.11.15-2.1 | 1.11.15-2.1 | Mar 9, 2018 | An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr | |
| CVE-2018-6188 | Hig | 7.5 | < 1.11.15-2.1 | 1.11.15-2.1 | Feb 5, 2018 | django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user a | |
| CVE-2017-12794 | Med | 6.1 | < 1.11.15-2.1 | 1.11.15-2.1 | Sep 7, 2017 | In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si | |
| CVE-2017-7234 | Med | 6.1 | < 1.11.15-2.1 | 1.11.15-2.1 | Apr 4, 2017 | A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability. | |
| CVE-2017-7233 | Med | 6.1 | < 1.11.15-2.1 | 1.11.15-2.1 | Apr 4, 2017 | Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh | |
| CVE-2015-5963 | — | < 1.11.15-2.1 | 1.11.15-2.1 | Aug 24, 2015 | contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of reque | ||
| CVE-2015-5145 | — | < 1.11.15-2.1 | 1.11.15-2.1 | Jul 14, 2015 | validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. | ||
| CVE-2015-3982 | — | < 1.11.15-2.1 | 1.11.15-2.1 | Jun 2, 2015 | The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. |
- affected < 1.11.15-2.1fixed 1.11.15-2.1
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a po
- affected < 1.11.15-2.1fixed 1.11.15-2.1
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
- affected < 1.11.15-2.1fixed 1.11.15-2.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking
- affected < 1.11.15-2.1fixed 1.11.15-2.1
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expr
- affected < 1.11.15-2.1fixed 1.11.15-2.1
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user a
- affected < 1.11.15-2.1fixed 1.11.15-2.1
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production si
- affected < 1.11.15-2.1fixed 1.11.15-2.1
A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
- affected < 1.11.15-2.1fixed 1.11.15-2.1
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they sh
- CVE-2015-5963Aug 24, 2015affected < 1.11.15-2.1fixed 1.11.15-2.1
contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of reque
- CVE-2015-5145Jul 14, 2015affected < 1.11.15-2.1fixed 1.11.15-2.1
validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
- CVE-2015-3982Jun 2, 2015affected < 1.11.15-2.1fixed 1.11.15-2.1
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.