CVSS: 6.5EPSS: 4%CPEs: 8EXPL: 0CVE-2012-4520
https://notcve.org/view.php?id=CVE-2012-4520
18 Nov 2012 — The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values. La función django.http.HttpRequest.get_host en Django v1.3.x antes de v1.3.4 y v1.4.x antes de v1.4.2, permite a atacantes remotos generar y mostrar URLs de su elección a través de nombre de usuario y contraseña de la cabecera Host manipulados. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691145 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 29EXPL: 0CVE-2012-3442
https://notcve.org/view.php?id=CVE-2012-3442
31 Jul 2012 — The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL. Las clases (1) django.http.HttpResponseRedirect y (2) django.http.HttpResponsePermanentRedirect en Django anteriores a v1.3.2 y v1.4.x anteriores a v1.4.1 no validan el esquema de un destino dredireccionado, lo que podrí... • http://www.debian.org/security/2012/dsa-2529 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 1%CPEs: 29EXPL: 0CVE-2012-3443
https://notcve.org/view.php?id=CVE-2012-3443
31 Jul 2012 — The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file. La clase django.forms.ImageField en el sistema de formularios en Django anteriores a v1.3.2 y v1.4.x anteriores a v1.4.1 descomprime completamente los datos de la imagen durante la validación de la misma, lo que permite a atacantes remotos provo... • http://www.debian.org/security/2012/dsa-2529 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 1%CPEs: 29EXPL: 0CVE-2012-3444
https://notcve.org/view.php?id=CVE-2012-3444
31 Jul 2012 — The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image. La función get_image_dimensions en la funcionalidad image-handling en Django anteriores a v1.3.2 y v1.4.x anteriores a v1.4.1 un tamaño de trozo constante en todos los intentos por determinar las dimensiones, lo q... • http://www.debian.org/security/2012/dsa-2529 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.8EPSS: 1%CPEs: 22EXPL: 0CVE-2011-4136
https://notcve.org/view.php?id=CVE-2011-4136
19 Oct 2011 — django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier. django.contrib.sessions en Django v1.2.7 y v1.3.x antereiores a v1.3.1, cuando los datos de sesión se almacena en la caché, utiliza el espacio de nombres raíz de los identificadores de sesión las te... • http://openwall.com/lists/oss-security/2011/09/11/1 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 1%CPEs: 22EXPL: 0CVE-2011-4137
https://notcve.org/view.php?id=CVE-2011-4137
19 Oct 2011 — The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521. La funcionalidad verify_exists de la implementación... • http://openwall.com/lists/oss-security/2011/09/11/1 • CWE-399: Resource Management Errors •
CVSS: 5.3EPSS: 0%CPEs: 22EXPL: 0CVE-2011-4138
https://notcve.org/view.php?id=CVE-2011-4138
19 Oct 2011 — The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header. La funcionalidad verify_exists de la implementación URLField en Django antes de su versión v1.2.7 y en v1.3.x antes de v1.3.1 orig... • http://openwall.com/lists/oss-security/2011/09/11/1 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 22EXPL: 0CVE-2011-4139
https://notcve.org/view.php?id=CVE-2011-4139
19 Oct 2011 — Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request. Django v1.2.7 y v1.3.x anterior a v1.3.1 usa la cabecera de una petición HTTP host para la construcción de una dirección URL completa, en determinadas circunstancias, lo que permite a atacantes remotos para realizar ataques de envenenamiento de caché a través de una solicitud manipulada. • http://openwall.com/lists/oss-security/2011/09/11/1 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 22EXPL: 0CVE-2011-4140
https://notcve.org/view.php?id=CVE-2011-4140
19 Oct 2011 — The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code. El mecanismo de protección ante CSRF de Django hasta la versión 1.2.7 y 1.3.x hasta la 1.3.1 no maneja apropiadamente las configuraciones del servidor web que soportan cabeceras HTTP Hos... • http://openwall.com/lists/oss-security/2011/09/11/1 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 2%CPEs: 9EXPL: 0CVE-2011-0696
https://notcve.org/view.php?id=CVE-2011-0696
14 Feb 2011 — Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447. Django v1.1.x antes de v1.1.4 y v1.2.x antes de v1.2.5 no valida correctamente las solicitudes HTTP que contienen una cabecera X-Requested-With , que facilita a l... • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054207.html • CWE-352: Cross-Site Request Forgery (CSRF) •