CVE search results

91 – 100 of 132 results

Detailed view

Sort by:

CVE-2014-0483

Low priority

Fixed

The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

CVE-2014-0482

Medium priority

Fixed

The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend,...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

CVE-2014-0481

Low priority

Fixed

The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

CVE-2014-0480

Low priority

Fixed

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

CVE-2014-3995

Medium priority

Ignored

Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.

2 affected packages

djblets, python-django-djblets

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
djblets	—	—	—	—	—
python-django-djblets	—	—	—	—	—

CVE-2014-3994

Medium priority

Ignored

Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a...

2 affected packages

djblets, python-django-djblets

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
djblets	—	—	—	—	—
python-django-djblets	—	—	—	—	—

CVE-2014-3730

Medium priority

Fixed

The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

CVE-2014-1418

Medium priority

Fixed

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

CVE-2014-0474

Medium priority

Fixed

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion,...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

CVE-2014-0473

Medium priority

Fixed

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by...

1 affected packages

python-django

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
python-django	—	—	—	—	—

Export to JSON

Results by page:

Search CVE reports