CVSS: 6.1EPSS: 14%CPEs: 13EXPL: 2CVE-2016-6186 – Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-6186
19 Jul 2016 — Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. Vulnerabilidad de XSS en la función dismissChangeRelatedObjectPopup en contrib/admin/static/admin/js/admin/RelatedObjectLookups.js en Django en versiones anteriores a 1.... • https://packetstorm.news/files/id/137965 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 3%CPEs: 9EXPL: 0CVE-2015-8213 – python-django: Information leak through date template filter
https://notcve.org/view.php?id=CVE-2015-8213
25 Nov 2015 — The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. La función get_format en utils/formats.py en Django en versiones anteriores a 1.7.x en versiones anteriores a 1.7.11, 1.8.x en versiones anteriores a 1.8.7 y 1.9.x en versiones anteriores a 1.9rc2 puede permitir a atacantes rem... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 7%CPEs: 43EXPL: 0CVE-2015-5963 – python-django: Denial-of-service possibility in logout() view by filling session store
https://notcve.org/view.php?id=CVE-2015-5963
18 Aug 2015 — contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record. Vulnerabilidad en contrib.sessions.middleware.SessionMiddleware en Django 1.8.x en versiones anteriores a 1.8.4, 1.7.x en versiones anteriores... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 2%CPEs: 43EXPL: 0CVE-2015-5964 – python-django: Denial-of-service possibility in logout() view by filling session store
https://notcve.org/view.php?id=CVE-2015-5964
18 Aug 2015 — The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. Vulnerabilidad en las funciones (1) contrib.sessions.backends.base.SessionBase.flush y (2) cache_db.SessionStore.flush en Django 1.7.x en versiones anteriores a 1.7.10, ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 4%CPEs: 3EXPL: 0CVE-2015-5145 – Gentoo Linux Security Advisory 201510-06
https://notcve.org/view.php?id=CVE-2015-5145
14 Jul 2015 — validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. validators.URLValidator en Django 1.8.x anteriores a 1.8.3 permite a atacantes causar una denegación de servicios mediante el consumo de la CPU a través de vectores no especificados. Multiple vulnerabilities have been found in Django, the worst of which may allow a remote attacker to cause Denial of Service. Versions less than 1.8.3 are affected. • http://www.securityfocus.com/bid/75691 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 1%CPEs: 58EXPL: 0CVE-2015-5144 – Debian Security Advisory 3305-1
https://notcve.org/view.php?id=CVE-2015-5144
09 Jul 2015 — Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. Django antes de 1.4.21, de 1.5.x hasta 1.6.x, 1.7.x anteriores a 1.7.9 y 1.8.x anteriores a 1.8.... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 15%CPEs: 57EXPL: 0CVE-2015-5143 – Django: possible DoS by filling session store
https://notcve.org/view.php?id=CVE-2015-5143
09 Jul 2015 — The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys. La sesión Backend en Django anteriores a 1.4.21, de 1.5.x hasta 1.6.x, 1.7.x anteriores a 1.7.9 y 1.8.x anteriores a 1.8.3, permite a un atacante causar una denegación de servicios mediante el consumo de almacenamiento de sesión a través de múltiples peticiones con una úni... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-3982
https://notcve.org/view.php?id=CVE-2015-3982
02 Jun 2015 — The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. La función session.flush en el backend cached_db en Django 1.8.x anterior a 1.8.2 no vacía correctamente la sesión, lo que permite a atacantes remotos secuestrar las sesiones de usuarios a través de una cadena vacía en la clave de la sesión. • http://www.securityfocus.com/bid/74960 •
CVSS: 4.3EPSS: 3%CPEs: 53EXPL: 0CVE-2015-2317 – Ubuntu Security Notice USN-2539-1
https://notcve.org/view.php?id=CVE-2015-2317
23 Mar 2015 — The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL. La función utils.http.is_safe_url en Django anterior a 1.4.20, 1.5.x, 1.6.x anterior a 1.6.11, 1.7.x anterior a 1.7.7, y 1.8.x anterior a 1.8c1 no valida correctamente las URLs, lo que permite a ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 3%CPEs: 36EXPL: 0CVE-2015-2316 – Ubuntu Security Notice USN-2539-1
https://notcve.org/view.php?id=CVE-2015-2316
23 Mar 2015 — The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string. La función utils.html.strip_tags en Django 1.6.x anterior a 1.6.11, 1.7.x anterior a 1.7.7, y 1.8.x anterior a 1.8c1, cuando utiliza ciertos versiones de Python, permite a atacantes remotos causar una denegación de servicio (bucle infinito) mediant... • http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155421.html • CWE-399: Resource Management Errors •