CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 0CVE-2013-0305 – Django: Data leakage via admin history log
https://notcve.org/view.php?id=CVE-2013-0305
02 May 2013 — The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information. La interfaz administrativa para Django v1.3.x antes de v1.3.6, v1.4.x antes de v1.4.4, y v1.5 antes de la release candidate v2 no comprueba los permisos para la vista del historial, que permite a usuarios administradores autenticados obtener informaci... • http://rhn.redhat.com/errata/RHSA-2013-0670.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 17EXPL: 0CVE-2013-0306 – Django: Formset denial-of-service
https://notcve.org/view.php?id=CVE-2013-0306
02 May 2013 — The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter. Vulnerabilidad sin especificar en el formulario "library" en Django v1.3.x antes de v1.3.6, v1.4.x antes de v1.4.4, v1.5 antes de release candidate v2 permite a atacantes remotos evitar las restricciones de los recursos y causar... • http://rhn.redhat.com/errata/RHSA-2013-0670.html • CWE-189: Numeric Errors •
CVSS: 6.5EPSS: 4%CPEs: 8EXPL: 0CVE-2012-4520
https://notcve.org/view.php?id=CVE-2012-4520
18 Nov 2012 — The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values. La función django.http.HttpRequest.get_host en Django v1.3.x antes de v1.3.4 y v1.4.x antes de v1.4.2, permite a atacantes remotos generar y mostrar URLs de su elección a través de nombre de usuario y contraseña de la cabecera Host manipulados. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 29EXPL: 0CVE-2012-3442
https://notcve.org/view.php?id=CVE-2012-3442
31 Jul 2012 — The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL. Las clases (1) django.http.HttpResponseRedirect y (2) django.http.HttpResponsePermanentRedirect en Django anteriores a v1.3.2 y v1.4.x anteriores a v1.4.1 no validan el esquema de un destino dredireccionado, lo que podrí... • http://www.debian.org/security/2012/dsa-2529 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 1%CPEs: 29EXPL: 0CVE-2012-3443
https://notcve.org/view.php?id=CVE-2012-3443
31 Jul 2012 — The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file. La clase django.forms.ImageField en el sistema de formularios en Django anteriores a v1.3.2 y v1.4.x anteriores a v1.4.1 descomprime completamente los datos de la imagen durante la validación de la misma, lo que permite a atacantes remotos provo... • http://www.debian.org/security/2012/dsa-2529 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 1%CPEs: 29EXPL: 0CVE-2012-3444
https://notcve.org/view.php?id=CVE-2012-3444
31 Jul 2012 — The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image. La función get_image_dimensions en la funcionalidad image-handling en Django anteriores a v1.3.2 y v1.4.x anteriores a v1.4.1 un tamaño de trozo constante en todos los intentos por determinar las dimensiones, lo q... • http://www.debian.org/security/2012/dsa-2529 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •