Search for packages
| purl | pkg:pypi/django@1.11.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2w9q-sann-aaak
Aliases: CVE-2019-14232 GHSA-c4qh-4vgv-qc6g PYSEC-2019-11 PYSEC-2019-81 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. |
Affected by 9 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-3sj8-9xug-aaap
Aliases: CVE-2019-12781 GHSA-6c7v-2f49-8h26 PYSEC-2019-10 PYSEC-2019-80 |
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP. |
Affected by 13 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 16 other vulnerabilities. Affected by 21 other vulnerabilities. Affected by 31 other vulnerabilities. |
|
VCID-d9pc-5fer-aaak
Aliases: CVE-2019-14233 GHSA-h5jv-4p7w-64jg PYSEC-2019-12 PYSEC-2019-82 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. |
Affected by 9 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-jefu-dz7u-aaac
Aliases: CVE-2019-6975 GHSA-wh4h-v3f2-r2pp PYSEC-2019-18 PYSEC-2019-88 |
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. |
Affected by 0 other vulnerabilities. Affected by 15 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 18 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 19 other vulnerabilities. Affected by 21 other vulnerabilities. |
|
VCID-pyaf-bv24-aaah
Aliases: CVE-2019-14234 GHSA-6r97-cj55-9hrq PYSEC-2019-13 PYSEC-2019-83 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function. |
Affected by 9 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-q58w-h5mb-aaaj
Aliases: CVE-2019-14235 GHSA-v9qg-3j8p-r63v PYSEC-2019-14 PYSEC-2019-84 |
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences. |
Affected by 9 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 27 other vulnerabilities. |
|
VCID-w5zz-sb5k-aaan
Aliases: CVE-2017-12794 GHSA-9r8w-6x8c-6jr9 PYSEC-2017-44 |
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings. |
Affected by 20 other vulnerabilities. |
|
VCID-wk4p-pp8w-aaag
Aliases: CVE-2018-14574 GHSA-5hg3-6c2f-f3wr PYSEC-2018-2 |
django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. |
Affected by 17 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-wtpw-b4cs-aaaf
Aliases: CVE-2019-12308 GHSA-7rp2-fm2h-wchj PYSEC-2019-79 PYSEC-2019-9 |
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. |
Affected by 14 other vulnerabilities. Affected by 10 other vulnerabilities. Affected by 17 other vulnerabilities. Affected by 21 other vulnerabilities. Affected by 32 other vulnerabilities. |
|
VCID-x5yz-7qtf-aaar
Aliases: BIT-2020-9402 BIT-django-2020-9402 CVE-2020-9402 GHSA-3gh2-xw74-jmcw PYSEC-2020-36 |
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL. |
Affected by 6 other vulnerabilities. Affected by 23 other vulnerabilities. Affected by 16 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-03-28T20:03:33.626947+00:00 | GHSA Importer | Affected by | VCID-q58w-h5mb-aaaj | None | 36.0.0 |
| 2025-03-28T20:03:33.586327+00:00 | GHSA Importer | Affected by | VCID-pyaf-bv24-aaah | None | 36.0.0 |
| 2025-03-28T20:03:33.420634+00:00 | GHSA Importer | Affected by | VCID-d9pc-5fer-aaak | None | 36.0.0 |
| 2025-03-28T20:03:33.379297+00:00 | GHSA Importer | Affected by | VCID-2w9q-sann-aaak | None | 36.0.0 |
| 2025-03-28T20:03:32.146738+00:00 | GHSA Importer | Affected by | VCID-3sj8-9xug-aaap | None | 36.0.0 |
| 2025-03-28T20:03:29.446315+00:00 | GHSA Importer | Affected by | VCID-wtpw-b4cs-aaaf | None | 36.0.0 |
| 2025-03-28T20:02:43.886927+00:00 | GHSA Importer | Affected by | VCID-wk4p-pp8w-aaag | None | 36.0.0 |
| 2025-01-17T02:30:30.423718+00:00 | GHSA Importer | Affected by | VCID-w5zz-sb5k-aaan | None | 35.1.0 |
| 2024-09-17T22:26:49.557356+00:00 | GitLab Importer | Affected by | VCID-jefu-dz7u-aaac | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2019-6975.yml | 34.0.1 |
| 2024-09-17T22:26:45.962155+00:00 | GitLab Importer | Affected by | VCID-w5zz-sb5k-aaan | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2017-12794.yml | 34.0.1 |
| 2024-09-17T22:17:00.250771+00:00 | GHSA Importer | Affected by | VCID-q58w-h5mb-aaaj | https://github.com/advisories/GHSA-v9qg-3j8p-r63v | 34.0.1 |
| 2024-09-17T22:14:03.133695+00:00 | GHSA Importer | Affected by | VCID-pyaf-bv24-aaah | https://github.com/advisories/GHSA-6r97-cj55-9hrq | 34.0.1 |
| 2024-09-17T22:13:48.074230+00:00 | GHSA Importer | Affected by | VCID-3sj8-9xug-aaap | https://github.com/advisories/GHSA-6c7v-2f49-8h26 | 34.0.1 |
| 2024-09-17T22:13:47.934171+00:00 | GHSA Importer | Affected by | VCID-2w9q-sann-aaak | https://github.com/advisories/GHSA-c4qh-4vgv-qc6g | 34.0.1 |
| 2024-09-17T22:13:47.766455+00:00 | GHSA Importer | Affected by | VCID-d9pc-5fer-aaak | https://github.com/advisories/GHSA-h5jv-4p7w-64jg | 34.0.1 |
| 2024-09-17T22:13:47.648766+00:00 | GHSA Importer | Affected by | VCID-wtpw-b4cs-aaaf | https://github.com/advisories/GHSA-7rp2-fm2h-wchj | 34.0.1 |
| 2024-09-17T22:13:45.760389+00:00 | GHSA Importer | Affected by | VCID-w5zz-sb5k-aaan | https://github.com/advisories/GHSA-9r8w-6x8c-6jr9 | 34.0.1 |
| 2024-09-17T22:13:13.650284+00:00 | GHSA Importer | Affected by | VCID-x5yz-7qtf-aaar | https://github.com/advisories/GHSA-3gh2-xw74-jmcw | 34.0.1 |
| 2024-05-07T21:57:10.680338+00:00 | GHSA Importer | Affected by | VCID-w5zz-sb5k-aaan | https://github.com/advisories/GHSA-9r8w-6x8c-6jr9 | 34.0.0rc4 |
| 2024-05-07T21:57:10.477560+00:00 | GHSA Importer | Affected by | VCID-wk4p-pp8w-aaag | https://github.com/advisories/GHSA-5hg3-6c2f-f3wr | 34.0.0rc4 |
| 2024-05-01T21:17:25.608541+00:00 | GHSA Importer | Affected by | VCID-2w9q-sann-aaak | https://github.com/advisories/GHSA-c4qh-4vgv-qc6g | 34.0.0rc4 |
| 2024-04-23T17:41:29.082174+00:00 | GHSA Importer | Affected by | VCID-wtpw-b4cs-aaaf | https://github.com/advisories/GHSA-7rp2-fm2h-wchj | 34.0.0rc4 |
| 2024-04-23T17:41:18.586844+00:00 | GHSA Importer | Affected by | VCID-x5yz-7qtf-aaar | https://github.com/advisories/GHSA-3gh2-xw74-jmcw | 34.0.0rc4 |
| 2024-01-03T17:52:46.964803+00:00 | GitLab Importer | Affected by | VCID-jefu-dz7u-aaac | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2019-6975.yml | 34.0.0rc1 |
| 2024-01-03T17:52:43.967922+00:00 | GitLab Importer | Affected by | VCID-w5zz-sb5k-aaan | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2017-12794.yml | 34.0.0rc1 |
| 2024-01-03T17:46:44.460824+00:00 | GHSA Importer | Affected by | VCID-q58w-h5mb-aaaj | https://github.com/advisories/GHSA-v9qg-3j8p-r63v | 34.0.0rc1 |
| 2024-01-03T17:44:12.611780+00:00 | GHSA Importer | Affected by | VCID-pyaf-bv24-aaah | https://github.com/advisories/GHSA-6r97-cj55-9hrq | 34.0.0rc1 |
| 2024-01-03T17:43:58.247085+00:00 | GHSA Importer | Affected by | VCID-3sj8-9xug-aaap | https://github.com/advisories/GHSA-6c7v-2f49-8h26 | 34.0.0rc1 |
| 2024-01-03T17:43:58.097459+00:00 | GHSA Importer | Affected by | VCID-2w9q-sann-aaak | https://github.com/advisories/GHSA-c4qh-4vgv-qc6g | 34.0.0rc1 |
| 2024-01-03T17:43:57.925075+00:00 | GHSA Importer | Affected by | VCID-d9pc-5fer-aaak | https://github.com/advisories/GHSA-h5jv-4p7w-64jg | 34.0.0rc1 |
| 2024-01-03T17:43:57.786246+00:00 | GHSA Importer | Affected by | VCID-wtpw-b4cs-aaaf | https://github.com/advisories/GHSA-7rp2-fm2h-wchj | 34.0.0rc1 |
| 2024-01-03T17:43:55.722578+00:00 | GHSA Importer | Affected by | VCID-w5zz-sb5k-aaan | https://github.com/advisories/GHSA-9r8w-6x8c-6jr9 | 34.0.0rc1 |
| 2024-01-03T17:43:55.167085+00:00 | GHSA Importer | Affected by | VCID-wk4p-pp8w-aaag | https://github.com/advisories/GHSA-5hg3-6c2f-f3wr | 34.0.0rc1 |