CVSS: 5.3EPSS: 2%CPEs: 8EXPL: 0CVE-2019-12781 – Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
https://notcve.org/view.php?id=CVE-2019-12781
01 Jul 2019 — An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. Se ha descubierto un problema en Django en versiones 1.11 anteriores a la 1.11.22, 2.1, anteriores a la 2.1.10, y 2.2 anteriores 2.2.3. Una petición HTTP no s... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html • CWE-319: Cleartext Transmission of Sensitive Information CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 6.1EPSS: 1%CPEs: 3EXPL: 0CVE-2019-12308 – Debian Security Advisory 4476-1
https://notcve.org/view.php?id=CVE-2019-12308
03 Jun 2019 — An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. Se descubrió un problema en Django 1.11 antes de 1.11.21, 2.1 anterior de la versión 2.1.9 y 2.2 anterior de la versión 2.2.2. El va... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 6%CPEs: 8EXPL: 0CVE-2019-6975 – Ubuntu Security Notice USN-3890-1
https://notcve.org/view.php?id=CVE-2019-6975
11 Feb 2019 — Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. Django, en versiones 1.11.x anteriores a la 1.11.19, versiones 2.0.x anteriores a la 2.0.11 y versiones 2.1.x anteriores a la 2.1.6, permite el consumo incontrolado de memoria mediante un valor malicioso proporcionado por el atacante a la función django.utils.numberformat.format(). Three security issues we... • http://www.securityfocus.com/bid/106964 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 1%CPEs: 10EXPL: 0CVE-2019-3498 – Ubuntu Security Notice USN-3851-1
https://notcve.org/view.php?id=CVE-2019-3498
08 Jan 2019 — In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. En Django, en versiones 1.11.x anteriores a la 1.11.18, versiones 2.0.x anteriores a la 2.0.10 y 2.1.x anteriores a la 2.1.5, existe una neutralización incorrecta de ele... • http://www.securityfocus.com/bid/106453 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 4.9EPSS: 1%CPEs: 1EXPL: 0CVE-2018-16984
https://notcve.org/view.php?id=CVE-2018-16984
02 Oct 2018 — An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes. Se ha descubierto un problema en Django, en versione... • http://www.securitytracker.com/id/1041749 • CWE-522: Insufficiently Protected Credentials •