Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 172

Export CSV
CVE-2019-19118

django: privilege escalation in the django admin

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Djangoproject Fedoraproject
Products
Django Fedora
CVE-2019-14235

Django: Potential memory exhaustion in django.utils.encoding.uri_to_iri()

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Djangoproject Opensuse Redhat
Products
Django Leap Openstack
CVE-2019-14234

Django: SQL injection possibility in key and index lookups for JSONField/HStoreField

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

CVSS 3.0 · 9.8 Critical EPSS 47.7% KEV · Not listed
Vendors
Debian Djangoproject Fedoraproject and 1 more
Products
Debian Linux Django Fedora and 1 more
CVE-2019-14233

Django: the behavior of the underlying HTMLParser leading to DoS

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Djangoproject Opensuse Redhat
Products
Django Leap Openstack
CVE-2019-14232

Django: backtracking in a regular expression in django.utils.text.Truncator leads to DoS

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Djangoproject Opensuse Redhat
Products
Django Leap Openstack
CVE-2019-12781

Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.

CVSS 3.0 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 1 more
Products
Ubuntu Linux Debian Linux Django and 3 more
CVE-2019-12308

django: missing URL validation by AdminURLFieldWidget leads to generation of clickable unsafe JavaScript link causing cross site scripting

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

CVSS 3.0 · 6.1 Medium EPSS 2.4% KEV · Not listed
Vendors
Djangoproject
Products
Django
CVE-2018-7537

django: Catastrophic backtracking in regular expressions via 'truncatechars_html' and 'truncatewords_html'

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.

CVSS 3.0 · 5.3 Medium EPSS 4.4% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 1 more
Products
Ubuntu Linux Debian Linux Django and 3 more
CVE-2018-7536

django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc'

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

CVSS 3.0 · 5.3 Medium EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Djangoproject and 1 more
Products
Ubuntu Linux Debian Linux Django and 4 more
CVE-2018-6188

django: Information leakage in AuthenticationForm

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.

CVSS 3.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Canonical Djangoproject Redhat
Products
Ubuntu Linux Django Satellite and 1 more
CVE-2018-16984

python-django: Password hash disclosure to "view only" admin users

An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.

CVSS 3.0 · 4.9 Medium EPSS 2.1% KEV · Not listed
Vendors
Djangoproject
Products
Django