Page 2 of 14 results (0.003 seconds)

CVSS: 6.1EPSS: 14%CPEs: 13EXPL: 2

CVE-2016-6186 – Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2016-6186

19 Jul 2016 — Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. Vulnerabilidad de XSS en la función dismissChangeRelatedObjectPopup en contrib/admin/static/admin/js/admin/RelatedObjectLookups.js en Django en versiones anteriores a 1.... • https://packetstorm.news/files/id/137965 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 3%CPEs: 9EXPL: 0

CVE-2015-8213 – python-django: Information leak through date template filter

https://notcve.org/view.php?id=CVE-2015-8213

25 Nov 2015 — The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY. La función get_format en utils/formats.py en Django en versiones anteriores a 1.7.x en versiones anteriores a 1.7.11, 1.8.x en versiones anteriores a 1.8.7 y 1.9.x en versiones anteriores a 1.9rc2 puede permitir a atacantes rem... • http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.3EPSS: 7%CPEs: 43EXPL: 0

CVE-2015-5963 – python-django: Denial-of-service possibility in logout() view by filling session store

https://notcve.org/view.php?id=CVE-2015-5963

18 Aug 2015 — contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record. Vulnerabilidad en contrib.sessions.middleware.SessionMiddleware en Django 1.8.x en versiones anteriores a 1.8.4, 1.7.x en versiones anteriores... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 5.3EPSS: 2%CPEs: 43EXPL: 0

CVE-2015-5964 – python-django: Denial-of-service possibility in logout() view by filling session store

https://notcve.org/view.php?id=CVE-2015-5964

18 Aug 2015 — The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors. Vulnerabilidad en las funciones (1) contrib.sessions.backends.base.SessionBase.flush y (2) cache_db.SessionStore.flush en Django 1.7.x en versiones anteriores a 1.7.10, ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172084.html • CWE-399: Resource Management Errors CWE-770: Allocation of Resources Without Limits or Throttling •