Search for packages
| purl | pkg:apk/alpine/py3-django@4.2.16-r0?arch=armhf&distroversion=v3.22&reponame=community |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-7tph-k8q2-bue2 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. |
BIT-django-2024-41991
CVE-2024-41991 GHSA-r836-hh6v-rg5g PYSEC-2024-69 |
| VCID-e2jd-yd4j-kqgt | Django allows enumeration of user e-mail addresses An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing). |
CVE-2024-45231
GHSA-rrqc-c2jx-6jgv |
| VCID-jzae-1awh-k7cm | An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. urlize and urlizetrunc were subject to a potential denial of service attack via certain inputs with a very large number of brackets. |
BIT-django-2024-38875
CVE-2024-38875 GHSA-qg2p-9jwr-mmqf PYSEC-2024-56 |
| VCID-m91a-6235-nye9 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg. |
BIT-django-2024-42005
CVE-2024-42005 GHSA-pv4p-cwwg-4rph PYSEC-2024-70 |
| VCID-mga4-an1w-qqf9 | Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. |
BIT-django-2024-45230
CVE-2024-45230 GHSA-5hgc-2vfp-mqvc PYSEC-2024-102 |
| VCID-q12d-kv8p-8ff7 | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. |
BIT-django-2024-39329
CVE-2024-39329 GHSA-x7q2-wr7g-xqmf PYSEC-2024-57 |
| VCID-u3zk-tff2-aua9 | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. get_supported_language_variant() was subject to a potential denial-of-service attack when used with very long strings containing specific characters. |
BIT-django-2024-39614
CVE-2024-39614 GHSA-f6f8-9mx6-9mx2 PYSEC-2024-59 |
| VCID-v1xr-z4zu-yfb4 | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent. |
BIT-django-2024-41989
CVE-2024-41989 GHSA-jh75-99hh-qvx9 PYSEC-2024-67 |
| VCID-xhpa-mffz-syfy | An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. |
BIT-django-2024-41990
CVE-2024-41990 GHSA-795c-9xpc-xw6g PYSEC-2024-68 |
| VCID-z27q-zfpz-ckby | An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.) |
BIT-django-2024-39330
CVE-2024-39330 GHSA-9jmf-237g-qf46 PYSEC-2024-58 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-03T17:58:10.720876+00:00 | Alpine Linux Importer | Fixing | VCID-mga4-an1w-qqf9 | https://secdb.alpinelinux.org/v3.22/community.json | 38.1.0 |
| 2026-04-03T17:55:05.922767+00:00 | Alpine Linux Importer | Fixing | VCID-xhpa-mffz-syfy | https://secdb.alpinelinux.org/v3.22/community.json | 38.1.0 |
| 2026-04-03T17:51:52.748066+00:00 | Alpine Linux Importer | Fixing | VCID-jzae-1awh-k7cm | https://secdb.alpinelinux.org/v3.22/community.json | 38.1.0 |
| 2026-04-03T17:49:14.984246+00:00 | Alpine Linux Importer | Fixing | VCID-e2jd-yd4j-kqgt | https://secdb.alpinelinux.org/v3.22/community.json | 38.1.0 |
| 2026-04-01T19:21:28.363200+00:00 | Alpine Linux Importer | Fixing | VCID-q12d-kv8p-8ff7 | https://secdb.alpinelinux.org/v3.22/community.json | 38.0.0 |
| 2026-04-01T19:16:05.298264+00:00 | Alpine Linux Importer | Fixing | VCID-m91a-6235-nye9 | https://secdb.alpinelinux.org/v3.22/community.json | 38.0.0 |
| 2026-04-01T19:05:15.161579+00:00 | Alpine Linux Importer | Fixing | VCID-7tph-k8q2-bue2 | https://secdb.alpinelinux.org/v3.22/community.json | 38.0.0 |
| 2026-04-01T19:02:16.622327+00:00 | Alpine Linux Importer | Fixing | VCID-v1xr-z4zu-yfb4 | https://secdb.alpinelinux.org/v3.22/community.json | 38.0.0 |
| 2026-04-01T18:52:36.408137+00:00 | Alpine Linux Importer | Fixing | VCID-u3zk-tff2-aua9 | https://secdb.alpinelinux.org/v3.22/community.json | 38.0.0 |
| 2026-04-01T18:51:26.551061+00:00 | Alpine Linux Importer | Fixing | VCID-z27q-zfpz-ckby | https://secdb.alpinelinux.org/v3.22/community.json | 38.0.0 |