Search for packages
| purl | pkg:pypi/django@1.5.0 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1n3j-dmkn-aaar
Aliases: CVE-2014-0472 GHSA-rvq6-mrpv-m6rm PYSEC-2014-1 |
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path." |
Affected by 33 other vulnerabilities. Affected by 34 other vulnerabilities. |
|
VCID-1zka-nz8a-aaab
Aliases: CVE-2014-3730 GHSA-vq3h-3q7v-9prw PYSEC-2014-20 |
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com." |
Affected by 31 other vulnerabilities. Affected by 32 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3neh-g91f-aaap
Aliases: CVE-2014-0480 GHSA-f7cm-ccfp-3q4r PYSEC-2014-4 |
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated. |
Affected by 27 other vulnerabilities. Affected by 28 other vulnerabilities. |
|
VCID-3wb8-gzmb-aaah
Aliases: CVE-2014-0482 GHSA-625g-gx8c-xcmg PYSEC-2014-6 |
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header. |
Affected by 27 other vulnerabilities. Affected by 28 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-482k-kc8y-aaas
Aliases: CVE-2015-5143 GHSA-h582-2pch-3xv3 PYSEC-2015-20 |
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys. |
Affected by 22 other vulnerabilities. Affected by 24 other vulnerabilities. |
|
VCID-a6xe-py95-aaab
Aliases: CVE-2013-6044 GHSA-9cwg-mhxf-hh59 PYSEC-2013-21 |
The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme. |
Affected by 38 other vulnerabilities. |
|
VCID-c4q6-kpvv-aaar
Aliases: CVE-2015-5144 GHSA-q5qw-4364-5hhm PYSEC-2015-10 |
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. |
Affected by 22 other vulnerabilities. Affected by 24 other vulnerabilities. |
|
VCID-cw41-fuky-aaak
Aliases: CVE-2014-1418 GHSA-q7q2-qf2q-rw3w PYSEC-2014-19 |
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers. |
Affected by 31 other vulnerabilities. Affected by 32 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ehad-3m6w-aaae
Aliases: CVE-2014-0474 GHSA-wqjj-hx84-v449 PYSEC-2014-3 |
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting." |
Affected by 33 other vulnerabilities. Affected by 34 other vulnerabilities. |
|
VCID-he54-pyj9-aaac
Aliases: CVE-2014-0481 GHSA-296w-6qhq-gf92 PYSEC-2014-5 |
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name. |
Affected by 27 other vulnerabilities. Affected by 28 other vulnerabilities. |
|
VCID-kd5p-kces-aaaq
Aliases: CVE-2013-1443 GHSA-4c42-4rxm-x6qf PYSEC-2013-18 |
The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed. |
Affected by 36 other vulnerabilities. |
|
VCID-uhzz-jmby-aaar
Aliases: CVE-2013-4249 GHSA-4894-5vqc-6r2r PYSEC-2013-19 |
Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField. |
Affected by 38 other vulnerabilities. |
|
VCID-y1zr-3yhy-aaak
Aliases: CVE-2014-0473 GHSA-89hj-xfx5-7q66 PYSEC-2014-2 |
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users. |
Affected by 33 other vulnerabilities. Affected by 34 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||