Search for packages
Package details: pkg:pypi/django@2.1.0
purl pkg:pypi/django@2.1.0
Tags Ghost
Next non-vulnerable version 4.2.22
Latest non-vulnerable version 5.2.2
Risk 4.5
Vulnerabilities affecting this package (9)
Vulnerability Summary Fixed by
VCID-2w9q-sann-aaak
Aliases:
CVE-2019-14232
GHSA-c4qh-4vgv-qc6g
PYSEC-2019-11
PYSEC-2019-81
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
2.1.11
Affected by 12 other vulnerabilities.
2.2.4
Affected by 27 other vulnerabilities.
VCID-3sj8-9xug-aaap
Aliases:
CVE-2019-12781
GHSA-6c7v-2f49-8h26
PYSEC-2019-10
PYSEC-2019-80
An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
2.1.10
Affected by 16 other vulnerabilities.
2.2a1
Affected by 21 other vulnerabilities.
2.2.3
Affected by 31 other vulnerabilities.
VCID-d9pc-5fer-aaak
Aliases:
CVE-2019-14233
GHSA-h5jv-4p7w-64jg
PYSEC-2019-12
PYSEC-2019-82
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
2.1.11
Affected by 12 other vulnerabilities.
2.2.4
Affected by 27 other vulnerabilities.
VCID-jefu-dz7u-aaac
Aliases:
CVE-2019-6975
GHSA-wh4h-v3f2-r2pp
PYSEC-2019-18
PYSEC-2019-88
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
2.1.6
Affected by 0 other vulnerabilities.
2.1.7
Affected by 19 other vulnerabilities.
2.2a1
Affected by 21 other vulnerabilities.
VCID-pyaf-bv24-aaah
Aliases:
CVE-2019-14234
GHSA-6r97-cj55-9hrq
PYSEC-2019-13
PYSEC-2019-83
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
2.1.11
Affected by 12 other vulnerabilities.
2.2.4
Affected by 27 other vulnerabilities.
VCID-q58w-h5mb-aaaj
Aliases:
CVE-2019-14235
GHSA-v9qg-3j8p-r63v
PYSEC-2019-14
PYSEC-2019-84
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
2.1.11
Affected by 12 other vulnerabilities.
2.2.4
Affected by 27 other vulnerabilities.
VCID-qs2z-b4r2-aaac
Aliases:
CVE-2019-19118
GHSA-hvmf-r92r-27hr
PYSEC-2019-15
PYSEC-2019-85
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
2.1.15
Affected by 11 other vulnerabilities.
2.2a1
Affected by 21 other vulnerabilities.
2.2.8
Affected by 26 other vulnerabilities.
3.0a1
Affected by 10 other vulnerabilities.
VCID-r4bp-3zs8-aaag
Aliases:
CVE-2019-3498
GHSA-337x-4q8g-prc5
PYSEC-2019-17
PYSEC-2019-87
In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
2.1.5
Affected by 20 other vulnerabilities.
VCID-wtpw-b4cs-aaaf
Aliases:
CVE-2019-12308
GHSA-7rp2-fm2h-wchj
PYSEC-2019-79
PYSEC-2019-9
An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
2.1.9
Affected by 17 other vulnerabilities.
2.2a1
Affected by 21 other vulnerabilities.
2.2.2
Affected by 32 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-03-28T20:03:53.692522+00:00 GHSA Importer Affected by VCID-jefu-dz7u-aaac None 36.0.0
2025-03-28T20:03:49.450900+00:00 GHSA Importer Affected by VCID-r4bp-3zs8-aaag None 36.0.0
2025-03-28T20:03:45.875559+00:00 GHSA Importer Affected by VCID-qs2z-b4r2-aaac None 36.0.0
2025-03-28T20:03:33.670181+00:00 GHSA Importer Affected by VCID-q58w-h5mb-aaaj None 36.0.0
2025-03-28T20:03:33.530918+00:00 GHSA Importer Affected by VCID-pyaf-bv24-aaah None 36.0.0
2025-03-28T20:03:33.502708+00:00 GHSA Importer Affected by VCID-d9pc-5fer-aaak None 36.0.0
2025-03-28T20:03:33.290531+00:00 GHSA Importer Affected by VCID-2w9q-sann-aaak None 36.0.0
2025-03-28T20:03:32.191311+00:00 GHSA Importer Affected by VCID-3sj8-9xug-aaap None 36.0.0
2025-03-28T20:03:29.300464+00:00 GHSA Importer Affected by VCID-wtpw-b4cs-aaaf None 36.0.0
2024-09-17T22:26:49.567157+00:00 GitLab Importer Affected by VCID-jefu-dz7u-aaac https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2019-6975.yml 34.0.1
2024-09-17T22:17:00.208852+00:00 GHSA Importer Affected by VCID-q58w-h5mb-aaaj https://github.com/advisories/GHSA-v9qg-3j8p-r63v 34.0.1
2024-09-17T22:14:03.094432+00:00 GHSA Importer Affected by VCID-pyaf-bv24-aaah https://github.com/advisories/GHSA-6r97-cj55-9hrq 34.0.1
2024-09-17T22:13:48.029301+00:00 GHSA Importer Affected by VCID-3sj8-9xug-aaap https://github.com/advisories/GHSA-6c7v-2f49-8h26 34.0.1
2024-09-17T22:13:47.878414+00:00 GHSA Importer Affected by VCID-2w9q-sann-aaak https://github.com/advisories/GHSA-c4qh-4vgv-qc6g 34.0.1
2024-09-17T22:13:47.727894+00:00 GHSA Importer Affected by VCID-d9pc-5fer-aaak https://github.com/advisories/GHSA-h5jv-4p7w-64jg 34.0.1
2024-09-17T22:13:47.610509+00:00 GHSA Importer Affected by VCID-wtpw-b4cs-aaaf https://github.com/advisories/GHSA-7rp2-fm2h-wchj 34.0.1
2024-09-17T22:13:45.605486+00:00 GHSA Importer Affected by VCID-jefu-dz7u-aaac https://github.com/advisories/GHSA-wh4h-v3f2-r2pp 34.0.1
2024-09-17T22:13:44.986387+00:00 GHSA Importer Affected by VCID-r4bp-3zs8-aaag https://github.com/advisories/GHSA-337x-4q8g-prc5 34.0.1
2024-09-17T22:13:16.522694+00:00 GHSA Importer Affected by VCID-qs2z-b4r2-aaac https://github.com/advisories/GHSA-hvmf-r92r-27hr 34.0.1
2024-05-01T21:17:25.544445+00:00 GHSA Importer Affected by VCID-2w9q-sann-aaak https://github.com/advisories/GHSA-c4qh-4vgv-qc6g 34.0.0rc4
2024-04-23T17:41:29.034448+00:00 GHSA Importer Affected by VCID-wtpw-b4cs-aaaf https://github.com/advisories/GHSA-7rp2-fm2h-wchj 34.0.0rc4
2024-04-23T17:41:21.734579+00:00 GHSA Importer Affected by VCID-qs2z-b4r2-aaac https://github.com/advisories/GHSA-hvmf-r92r-27hr 34.0.0rc4
2024-01-03T17:52:46.974385+00:00 GitLab Importer Affected by VCID-jefu-dz7u-aaac https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Django/CVE-2019-6975.yml 34.0.0rc1
2024-01-03T17:46:44.409341+00:00 GHSA Importer Affected by VCID-q58w-h5mb-aaaj https://github.com/advisories/GHSA-v9qg-3j8p-r63v 34.0.0rc1
2024-01-03T17:46:43.983644+00:00 GHSA Importer Affected by VCID-qs2z-b4r2-aaac https://github.com/advisories/GHSA-hvmf-r92r-27hr 34.0.0rc1
2024-01-03T17:44:12.578214+00:00 GHSA Importer Affected by VCID-pyaf-bv24-aaah https://github.com/advisories/GHSA-6r97-cj55-9hrq 34.0.0rc1
2024-01-03T17:43:58.196801+00:00 GHSA Importer Affected by VCID-3sj8-9xug-aaap https://github.com/advisories/GHSA-6c7v-2f49-8h26 34.0.0rc1
2024-01-03T17:43:58.040934+00:00 GHSA Importer Affected by VCID-2w9q-sann-aaak https://github.com/advisories/GHSA-c4qh-4vgv-qc6g 34.0.0rc1
2024-01-03T17:43:57.879306+00:00 GHSA Importer Affected by VCID-d9pc-5fer-aaak https://github.com/advisories/GHSA-h5jv-4p7w-64jg 34.0.0rc1
2024-01-03T17:43:57.747629+00:00 GHSA Importer Affected by VCID-wtpw-b4cs-aaaf https://github.com/advisories/GHSA-7rp2-fm2h-wchj 34.0.0rc1
2024-01-03T17:43:55.571911+00:00 GHSA Importer Affected by VCID-jefu-dz7u-aaac https://github.com/advisories/GHSA-wh4h-v3f2-r2pp 34.0.0rc1
2024-01-03T17:43:54.990584+00:00 GHSA Importer Affected by VCID-r4bp-3zs8-aaag https://github.com/advisories/GHSA-337x-4q8g-prc5 34.0.0rc1