CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-19118 – Gentoo Linux Security Advisory 202004-17
https://notcve.org/view.php?id=CVE-2019-19118
02 Dec 2019 — Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal ... • http://www.openwall.com/lists/oss-security/2019/12/02/1 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 5%CPEs: 4EXPL: 0CVE-2019-14233 – Django: the behavior of the underlying HTMLParser leading to DoS
https://notcve.org/view.php?id=CVE-2019-14233
01 Aug 2019 — An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. Se detectó un problema en Django versiones 1.11.x anteriores a 1.11.23, versiones 2.1.x anteriores a 2.1.11 y versiones 2.2.x anteriores a 2.2.4. Debido al comportamiento del HTMLParser subyacente, django.utils.html.... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 5%CPEs: 4EXPL: 0CVE-2019-14235 – Django: Potential memory exhaustion in django.utils.encoding.uri_to_iri()
https://notcve.org/view.php?id=CVE-2019-14235
01 Aug 2019 — An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences. Se detectó un problema en Django versiones 1.11.x anteriores a 1.11.23, versiones 2.1.x anteriores a 2.1.11 y versiones 2.2.x anteriores a 2.2.4. Si pasaron ciertas entradas, django.utils.encoding.uri_to_iri podría conllevar a un uso de l... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html • CWE-400: Uncontrolled Resource Consumption CWE-674: Uncontrolled Recursion •
CVSS: 7.5EPSS: 2%CPEs: 4EXPL: 0CVE-2019-14232 – Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS
https://notcve.org/view.php?id=CVE-2019-14232
01 Aug 2019 — An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. Se detectó un problema en Django versione... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 19%CPEs: 6EXPL: 1CVE-2019-14234 – Django: SQL injection possibility in key and index lookups for JSONField/HStoreField
https://notcve.org/view.php?id=CVE-2019-14234
01 Aug 2019 — An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed t... • https://github.com/malvika-thakur/CVE-2019-14234 • CWE-20: Improper Input Validation CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 2%CPEs: 8EXPL: 0CVE-2019-12781 – Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
https://notcve.org/view.php?id=CVE-2019-12781
01 Jul 2019 — An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. Se ha descubierto un problema en Django en versiones 1.11 anteriores a la 1.11.22, 2.1, anteriores a la 2.1.10, y 2.2 anteriores 2.2.3. Una petición HTTP no s... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html • CWE-319: Cleartext Transmission of Sensitive Information CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 6.1EPSS: 1%CPEs: 3EXPL: 0CVE-2019-12308 – Debian Security Advisory 4476-1
https://notcve.org/view.php?id=CVE-2019-12308
03 Jun 2019 — An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. Se descubrió un problema en Django 1.11 antes de 1.11.21, 2.1 anterior de la versión 2.1.9 y 2.2 anterior de la versión 2.2.2. El va... • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 6%CPEs: 8EXPL: 0CVE-2019-6975 – Ubuntu Security Notice USN-3890-1
https://notcve.org/view.php?id=CVE-2019-6975
11 Feb 2019 — Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. Django, en versiones 1.11.x anteriores a la 1.11.19, versiones 2.0.x anteriores a la 2.0.11 y versiones 2.1.x anteriores a la 2.1.6, permite el consumo incontrolado de memoria mediante un valor malicioso proporcionado por el atacante a la función django.utils.numberformat.format(). Three security issues we... • http://www.securityfocus.com/bid/106964 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 2%CPEs: 10EXPL: 0CVE-2019-3498 – Ubuntu Security Notice USN-3851-1
https://notcve.org/view.php?id=CVE-2019-3498
08 Jan 2019 — In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. En Django, en versiones 1.11.x anteriores a la 1.11.18, versiones 2.0.x anteriores a la 2.0.10 y 2.1.x anteriores a la 2.1.5, existe una neutralización incorrecta de ele... • http://www.securityfocus.com/bid/106453 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 4.9EPSS: 1%CPEs: 1EXPL: 0CVE-2018-16984
https://notcve.org/view.php?id=CVE-2018-16984
02 Oct 2018 — An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes. Se ha descubierto un problema en Django, en versione... • http://www.securitytracker.com/id/1041749 • CWE-522: Insufficiently Protected Credentials •