Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 167

Export CSV
CVE-2021-35042

django: potential SQL injection via unsanitized QuerySet.order_by() input

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

CVSS 3.1 · 9.8 Critical EPSS 44.4% KEV · Not listed
Vendors
Djangoproject Fedoraproject
Products
Django Fedora
CVE-2021-33571

django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Openstack and 2 more
CVE-2021-33203

django: Potential directory traversal via ``admindocs``

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

CVSS 3.1 · 4.9 Medium EPSS 2.7% KEV · Not listed
Vendors
Djangoproject Fedoraproject Redhat
Products
Django Fedora Openstack and 2 more
CVE-2021-32052

django: header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.

CVSS 3.1 · 6.1 Medium EPSS 3.2% KEV · Not listed
Vendors
Djangoproject Fedoraproject Python
Products
Django Fedora Python
CVE-2021-31542

django: Potential directory-traversal via uploaded files

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 3 more
CVE-2021-28658

django: potential directory-traversal via uploaded files

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS 3.8% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 3 more
CVE-2020-9402

django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

CVSS 3.1 · 8.8 High EPSS 24.0% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 3 more
Products
Ubuntu Linux Debian Linux Django and 4 more
CVE-2020-7471

django: potential SQL injection via StringAgg(delimiter)

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

CVSS 3.1 · 9.8 Critical EPSS 65.6% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2020-24584

django: permission escalation in intermediate-level directories of the file system cache on Python 3.7+

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Canonical Djangoproject Fedoraproject and 1 more
Products
Ubuntu Linux Django Fedora and 1 more
CVE-2020-24583

django: incorrect permissions on intermediate-level directories on Python 3.7+

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Canonical Djangoproject Fedoraproject and 1 more
Products
Ubuntu Linux Django Fedora and 1 more
CVE-2020-13596

django: possible XSS via admin ForeignKeyRawIdWidget

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.

CVSS 3.1 · 6.1 Medium EPSS 2.9% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 3 more
Products
Ubuntu Linux Debian Linux Django and 4 more
CVE-2020-13254

django: potential data leakage via malformed memcached keys

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.

CVSS 3.1 · 5.9 Medium EPSS 6.1% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 4 more
Products
Ubuntu Linux Debian Linux Django and 5 more
CVE-2019-6975

python-django: memory exhaustion in django.utils.numberformat.format()

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Canonical Djangoproject Fedoraproject
Products
Ubuntu Linux Django Fedora
CVE-2019-3498

python-django: Content spoofing via URL path in default 404 page

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.

CVSS 3.0 · 6.5 Medium EPSS 3.4% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 1 more
Products
Ubuntu Linux Debian Linux Django and 1 more
CVE-2019-19844

Django: crafted email address allows account takeover

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

CVSS 3.1 · 9.8 Critical EPSS 53.6% KEV · Not listed
Vendors
Canonical Djangoproject
Products
Ubuntu Linux Django
CVE-2019-19118

django: privilege escalation in the django admin

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Djangoproject Fedoraproject
Products
Django Fedora
CVE-2019-14235

Django: Potential memory exhaustion in django.utils.encoding.uri_to_iri()

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Djangoproject Opensuse Redhat
Products
Django Leap Openstack
CVE-2019-14234

Django: SQL injection possibility in key and index lookups for JSONField/HStoreField

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

CVSS 3.0 · 9.8 Critical EPSS 47.7% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 1 more
CVE-2019-14233

Django: the behavior of the underlying HTMLParser leading to DoS

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Djangoproject Opensuse Redhat
Products
Django Leap Openstack
CVE-2019-14232

Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Djangoproject Opensuse Redhat
Products
Django Leap Openstack