CVSS: 6.1EPSS: 0%CPEs: 49EXPL: 0CVE-2017-7233 – python-django: Open redirect and possible XSS attack via user-supplied numeric redirect URLs
https://notcve.org/view.php?id=CVE-2017-7233
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. Django 1.10 en versiones anteriores a 1.10.7, 1.9 en versiones anteriores a 1.9.13, y 1.8 en versiones anteriores a 1.8.18 se basa en la entrada del usuario en algunos casos para redirigir al usuario a una URL de "éxito". La comprobación de seguridad de estos redireccionamientos (a saber, `` django.utils.http.is_safe_url()``) considera que algunas URL numéricas son "seguras" cuando no deberían serlo, también conocida como una vulnerabilidad de redirección abierta. • http://www.debian.org/security/2017/dsa-3835 http://www.securityfocus.com/bid/97406 http://www.securitytracker.com/id/1038177 https://access.redhat.com/errata/RHSA-2017:1445 https://access.redhat.com/errata/RHSA-2017:1451 https://access.redhat.com/errata/RHSA-2017:1462 https://access.redhat.com/errata/RHSA-2017:1470 https://access.redhat.com/errata/RHSA-2017:1596 https://access.redhat.com/errata/RHSA-2017:3093 https://access.redhat.com/errata/RHSA-2018:2927 https:&#x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.1EPSS: 1%CPEs: 36EXPL: 0CVE-2016-9014
https://notcve.org/view.php?id=CVE-2016-9014
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. Django en versiones anteriores a 1.8.x en versiones anteriores a 1.8.16, 1.9.x en versiones anteriores a 1.9.11 y 1.10.x en versiones anteriores a 1.10.3 cuando settings.DEBUG es True, permiten a atacantes remotos llevar a cabo ataques de revinculación DNS aprovechando el fallo para validar la cabecera del Host HTTP contra settings.ALLOWED_HOSTS. • http://www.debian.org/security/2017/dsa-3835 http://www.securityfocus.com/bid/94068 http://www.securitytracker.com/id/1037159 http://www.ubuntu.com/usn/USN-3115-1 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S https://www.djangoproject.com/weblog/2016/nov/01/security-releases • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 36EXPL: 0CVE-2016-9013
https://notcve.org/view.php?id=CVE-2016-9013
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. Django 1.8.x en versiones anteriores a 1.8.16, 1.9.x en versiones anteriores a 1.9.11 y 1.10.x en versiones anteriores a 1.10.3 utiliza una contraseña embebida para un usuario de base de datos temporal creada al ejecutar pruebas con una base de datos Oracle, lo que hace más fácil a atacantes remotos obtener acceso al servidor de la base de datos aprovechando el fallo para especificar manualmente una contraseña en la configuración del diccionario TEST de la base de datos. • http://www.debian.org/security/2017/dsa-3835 http://www.securityfocus.com/bid/94069 http://www.securitytracker.com/id/1037159 http://www.ubuntu.com/usn/USN-3115-1 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S https://www.djangoproject.com/weblog/2016/nov/01/security-releases • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2016-7401 – python-django: CSRF protection bypass on a site with Google Analytics
https://notcve.org/view.php?id=CVE-2016-7401
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. El código de análisis de cookie en Django en versiones anteriores a 1.8.15 y 1.9.x en versiones anteriores a 1.9.10, cuando se utiliza en un sitio con Google Analytics, permite a atacantes remotos eludir un mecanismo de protección CSRF destinado estableciendo cookies arbitrarias. A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. In this update, the parser for ''request.COOKIES'' has been simplified to better match browser behavior and to mitigate this attack. ''request.COOKIES'' may now contain cookies that are invalid according to RFC 6265 but are possible to set using ''document.cookie''. • http://rhn.redhat.com/errata/RHSA-2016-2038.html http://rhn.redhat.com/errata/RHSA-2016-2039.html http://rhn.redhat.com/errata/RHSA-2016-2040.html http://rhn.redhat.com/errata/RHSA-2016-2041.html http://rhn.redhat.com/errata/RHSA-2016-2042.html http://rhn.redhat.com/errata/RHSA-2016-2043.html http://www.debian.org/security/2016/dsa-3678 http://www.securityfocus.com/bid/93182 http://www.securitytracker.com/id/1036899 http://www.ubuntu.com/usn/USN-3089- • CWE-254: 7PK - Security Features CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 1CVE-2016-6186 – Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-6186
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. Vulnerabilidad de XSS en la función dismissChangeRelatedObjectPopup en contrib/admin/static/admin/js/admin/RelatedObjectLookups.js en Django en versiones anteriores a 1.8.14, 1.9.x en versiones anteriores a 1.9.8 y 1.10.x en versiones anteriores a 1.10rc1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectors relacionados con el uso no seguro de Element.innerHTML. A cross-site scripting (XSS) flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related pop-up. Element.textContent is now used to prevent XSS data execution. • https://www.exploit-db.com/exploits/40129 http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html http://rhn.redhat.com/errata/RHSA-2016-1594.html http://rhn.redhat.com/errata/RHSA-2016-1595.html http://rhn.redhat.com/errata/RHSA-2016-1596.html http://seclists.org/fulldisclosure/2016/Jul/53 http://www.debian.org/security/2016/dsa-3622 http://www.securityfocus.com/archive/1/538947/100/0/threaded http://www.securityfocus.com/bid/92058 http:/& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •