VulnerableCode Package Details - pkg:alpm/archlinux/python-django@2.2.1-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-tv97-anfg-aaam Aliases: CVE-2019-11358 GHSA-6c3j-c64m-qhgq	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.	2.2.2-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-wtpw-b4cs-aaaf Aliases: CVE-2019-12308 GHSA-7rp2-fm2h-wchj PYSEC-2019-79 PYSEC-2019-9	An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.	2.2.2-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-tv97-anfg-aaam
Aliases:
CVE-2019-11358
GHSA-6c3j-c64m-qhgq

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

2.2.2-1
Affected by 1 other vulnerability.

VCID-wtpw-b4cs-aaaf
Aliases:
CVE-2019-12308
GHSA-7rp2-fm2h-wchj
PYSEC-2019-79
PYSEC-2019-9

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

2.2.2-1
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T07:46:51.552532+00:00	Arch Linux Importer	Affected by	VCID-tv97-anfg-aaam	https://security.archlinux.org/AVG-969	36.0.0
2025-03-28T07:46:51.519576+00:00	Arch Linux Importer	Affected by	VCID-wtpw-b4cs-aaaf	https://security.archlinux.org/AVG-969	36.0.0
2024-10-12T00:59:57.503074+00:00	Arch Linux Importer	Affected by	VCID-tv97-anfg-aaam	https://security.archlinux.org/AVG-969	34.0.2
2024-10-12T00:59:57.474400+00:00	Arch Linux Importer	Affected by	VCID-wtpw-b4cs-aaaf	https://security.archlinux.org/AVG-969	34.0.2
2024-09-18T02:02:12.460821+00:00	Arch Linux Importer	Affected by	VCID-tv97-anfg-aaam	https://security.archlinux.org/AVG-969	34.0.1
2024-09-18T02:02:12.436493+00:00	Arch Linux Importer	Affected by	VCID-wtpw-b4cs-aaaf	https://security.archlinux.org/AVG-969	34.0.1
2024-04-23T19:47:34.413033+00:00	Arch Linux Importer	Affected by	VCID-tv97-anfg-aaam	https://security.archlinux.org/AVG-969	34.0.0rc4
2024-04-23T19:47:34.390404+00:00	Arch Linux Importer	Affected by	VCID-wtpw-b4cs-aaaf	https://security.archlinux.org/AVG-969	34.0.0rc4
2024-01-03T22:28:14.774006+00:00	Arch Linux Importer	Affected by	VCID-tv97-anfg-aaam	https://security.archlinux.org/AVG-969	34.0.0rc1
2024-01-03T22:28:14.752376+00:00	Arch Linux Importer	Affected by	VCID-wtpw-b4cs-aaaf	https://security.archlinux.org/AVG-969	34.0.0rc1