CVSS: 3.7EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21416 – Potential sensitive information disclosed in error reports
https://notcve.org/view.php?id=CVE-2021-21416
django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters to sensitive data, with the result that sensitive data could be included in error reports rather than removed automatically by Django. Triggering this requires: A site is using django-registration < 3.1.2, The site has detailed error reports (such as Django's emailed error reports to site staff/developers) enabled and a server-side error (HTTP 5xx) occurs during an attempt by a user to register an account. Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password). django-registration es un paquete de registro de usuarios para Django. • https://github.com/ubernostrum/django-registration/security/advisories/GHSA-58c7-px5v-82hh • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2019-13177
https://notcve.org/view.php?id=CVE-2019-13177
verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument. El archivo verification.py en django-rest-registration (también conocida como biblioteca de registro REST de Django) anterior a la versión 0.5.0 consiste en una cadena estática para firmas (es decir, la API de firma de Django es usada inapropiadamente), lo que permite a los atacantes remotos suplantar el proceso de comprobación. Esto ocurre porque la refactorización del código incorrecta conllevó a llamar a una función crítica de seguridad con un argumento incorrecto. • https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0 https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xh • CWE-347: Improper Verification of Cryptographic Signature •