CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22199 – Django Template Engine Vulnerable to XSS
https://notcve.org/view.php?id=CVE-2024-22199
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious scripts in users' browsers when visiting affected web pages. The vulnerability has been addressed, the template engine now defaults to having autoescape set to `true`, effectively mitigating the risk of XSS attacks. Este paquete proporciona métodos universales para usar múltiples motores de plantillas con el framework web de Fiber mediante la interfaz de Views. Esta vulnerabilidad afecta específicamente a las aplicaciones web que procesan datos proporcionados por el usuario a través de este motor de plantillas, lo que podría provocar la ejecución de scripts maliciosos en los navegadores de los usuarios cuando visitan las páginas web afectadas. • https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b5396954676d624b6cb46 https://github.com/gofiber/template/security/advisories/GHSA-4mq2-gc4j-cmw6 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-116: Improper Encoding or Escaping of Output •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33203 – django: Potential directory traversal via ``admindocs``
https://notcve.org/view.php?id=CVE-2021-33203
Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. Django versiones anteriores a 2.2.24, versiones 3.x anteriores a 3.1.12 y versiones 3.2.x anteriores a 3.2.4, presenta un potencial salto de directorio por medio de django.contrib.admindocs. • https://docs.djangoproject.com/en/3.2/releases/security https://groups.google.com/forum/#%21forum/django-announce https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV https://security.netapp.com/advisory/ntap-20210727-0004 https://www.djangoproject.com/weblog/2021/jun/02/security-releases https://access.redhat.com/security/cve/CVE-2021-33203 https://bugzilla.redhat.com/show_bug.cgi?id=1966251 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 22%CPEs: 7EXPL: 1CVE-2019-19844 – Django < 3.0 < 2.2 < 1.11 - Account Hijack
https://notcve.org/view.php?id=CVE-2019-19844
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) Django versiones anteriores a 1.11.27, versiones 2.x anteriores a 2.2.9 y versiones 3.x anteriores a 3.0.1, permite tomar el control de la cuenta. Una dirección de correo electrónico diseñada adecuadamente (que es igual a la dirección de correo electrónico de un usuario existente después de la transformación de mayúsculas y minúsculas de los caracteres Unicode) permitiría a un atacante enviarle un token de restablecimiento de contraseña para la cuenta de usuario coincidente. • https://www.exploit-db.com/exploits/47879 http://packetstormsecurity.com/files/155872/Django-Account-Hijack.html https://docs.djangoproject.com/en/dev/releases/security https://groups.google.com/forum/#%21topic/django-announce/3oaB2rVH3a0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCM2DPUI7TOZWN4A6JFQFUVQ2XGE7GUD https://seclists.org/bugtraq/2020/Jan/9 https://security.gentoo.org/glsa/202004-17 https://security.netapp.com/advisory/ntap-20200110-0003 https& • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2016-7401 – python-django: CSRF protection bypass on a site with Google Analytics
https://notcve.org/view.php?id=CVE-2016-7401
The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. El código de análisis de cookie en Django en versiones anteriores a 1.8.15 y 1.9.x en versiones anteriores a 1.9.10, cuando se utiliza en un sitio con Google Analytics, permite a atacantes remotos eludir un mecanismo de protección CSRF destinado estableciendo cookies arbitrarias. A CSRF flaw was found in Django, where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. In this update, the parser for ''request.COOKIES'' has been simplified to better match browser behavior and to mitigate this attack. ''request.COOKIES'' may now contain cookies that are invalid according to RFC 6265 but are possible to set using ''document.cookie''. • http://rhn.redhat.com/errata/RHSA-2016-2038.html http://rhn.redhat.com/errata/RHSA-2016-2039.html http://rhn.redhat.com/errata/RHSA-2016-2040.html http://rhn.redhat.com/errata/RHSA-2016-2041.html http://rhn.redhat.com/errata/RHSA-2016-2042.html http://rhn.redhat.com/errata/RHSA-2016-2043.html http://www.debian.org/security/2016/dsa-3678 http://www.securityfocus.com/bid/93182 http://www.securitytracker.com/id/1036899 http://www.ubuntu.com/usn/USN-3089- • CWE-254: 7PK - Security Features CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 1CVE-2016-6186 – Django CMS 3.3.0 - Editor Snippet Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-6186
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML. Vulnerabilidad de XSS en la función dismissChangeRelatedObjectPopup en contrib/admin/static/admin/js/admin/RelatedObjectLookups.js en Django en versiones anteriores a 1.8.14, 1.9.x en versiones anteriores a 1.9.8 y 1.10.x en versiones anteriores a 1.10rc1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectors relacionados con el uso no seguro de Element.innerHTML. A cross-site scripting (XSS) flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related pop-up. Element.textContent is now used to prevent XSS data execution. • https://www.exploit-db.com/exploits/40129 http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html http://rhn.redhat.com/errata/RHSA-2016-1594.html http://rhn.redhat.com/errata/RHSA-2016-1595.html http://rhn.redhat.com/errata/RHSA-2016-1596.html http://seclists.org/fulldisclosure/2016/Jul/53 http://www.debian.org/security/2016/dsa-3622 http://www.securityfocus.com/archive/1/538947/100/0/threaded http://www.securityfocus.com/bid/92058 http:/& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •