Iniciar sesión
Deutsch English Español Polski
Baja

Django: has_vary_header may expose cached responses when Vary values contain whitespace

  • Publicada: 03.06.2026
  • Actualizado: 11.10.2026 15:17

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.utils.cache.has_vary_header() in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) django < 5.2.15, >= 6.0.0, < 6.0.6 5.2.15, 6.0.6

Referencias

Puntuación CVSS 3.1/10
Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Debilidad (CWE)
CWE-1023
Plataforma
Python (PyPI)
Paquete
django
Publicada
03.06.2026
Actualizado
11.10.2026 15:17

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-198 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-923m-gv2p-w5qp - CC BY 4.0

Historial de vulnerabilidades: django

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (162) en el archivo
Entradas en total
162
Primera → última
10.2007 08.2026
Sin corrección
1
Explotada en ataques
0

Distribución por gravedad

  • Crítica 16
  • Alta 65
  • Media 63
  • Baja 18

Divulgaciones por año

antes: 56

Gravedad:
  1. Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
    Alta · 8.8 CVE-2026-15307 < 5.2.17, >= 6.0a1, < 6.0.8 5.2.17, 6.0.8
  2. Django: has_vary_header may expose cached responses when Vary values contain whitespace esta entrada
    Baja · 3.1 CVE-2026-48587 < 5.2.15, >= 6.0.0, < 6.0.6 5.2.15, 6.0.6
  3. Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
    Alta · 7.5 CVE-2026-3902 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  4. Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
    Alta · 7.5 CVE-2026-33034 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  5. Django vulnerable to Uncontrolled Resource Consumption
    Alta · 7.5 CVE-2026-25673 >= 6.0, < 6.0.3, >= 5.2, < 5.2.12, >= 4.2, < 4.2.29 6.0.3, 5.2.12, 4.2.29
  6. Django has an SQL Injection issue
    Alta CVE-2026-1287 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  7. Django has an SQL Injection issue
    Alta CVE-2026-1207 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  8. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
    Crítica · 9.1 CVE-2025-64459 >= 4.2, < 4.2.26, >= 5.1, < 5.1.14, >= 5.2, < 5.2.8 4.2.26, 5.1.14, 5.2.8
  9. Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    Alta · 7.5 CVE-2025-64458 >= 5.2a1, < 5.2.8, >= 5.0a1, < 5.1.14, < 4.2.26 5.2.8, 5.1.14, 4.2.26
  10. Django vulnerable to SQL injection in column aliases
    Alta · 7.1 CVE-2025-59681 >= 4.2, < 4.2.25, >= 5.1, < 5.1.13, >= 5.2, < 5.2.7 4.2.25, 5.1.13, 5.2.7
  11. Django is subject to SQL injection through its column aliases
    Alta · 7.1 CVE-2025-57833 < 4.2.24, >= 5.0a1, < 5.1.12, >= 5.2a1, < 5.2.6 4.2.24, 5.1.12, 5.2.6
  12. Django SQL injection in HasKey(lhs, rhs) on Oracle
    Alta · 9.8 CVE-2024-53908 >= 5.0.0, < 5.0.10, >= 5.1.0, < 5.1.4, >= 4.2.0, < 4.2.17, >= 5.1, < 5.1.4, >= 5.0, < 5.0.10, >= 4.2, < 4.2.17 5.0.10, 5.1.4, 4.2.17
  13. An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a cr
    Crítica · 9.1 CVE-2024-42005 >= 5.0, < 5.0.8, >= 4.2, < 4.2.15 5.0.8, 4.2.15
  14. Django vulnerable to Denial of Service
    Alta · 7.5 CVE-2024-39614 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  15. Django Path Traversal vulnerability
    Alta · 7.5 CVE-2024-39330 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  16. Django vulnerable to Denial of Service
    Alta · 7.5 CVE-2024-38875 >= 4.2, < 4.2.14, >= 5.0, < 5.0.7 4.2.14, 5.0.7
  17. Django denial-of-service attack in the intcomma template filter
    Alta · 5.9 CVE-2024-24680 >= 3.2, < 3.2.24, >= 4.2, < 4.2.10, >= 5.0, < 5.0.2 3.2.24, 4.2.10, 5.0.2
  18. In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
    Alta · 5.9 CVE-2023-43665 >= 3.2, < 3.2.22, >= 4.1, < 4.1.12, >= 4.2, < 4.2.6 3.2.22, 4.1.12, 4.2.6
  19. An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
    Alta · 7.5 CVE-2023-46695 >= 3.2, < 3.2.23, >= 4.1, < 4.1.13, >= 4.2, < 4.2.7 3.2.23, 4.1.13, 4.2.7
  20. In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
    Alta · 7.5 CVE-2023-36053 >= 4.2, < 4.2.3, >= 4.0, < 4.1.10, >= 3.2, < 3.2.20 4.2.3, 4.1.10, 3.2.20
  21. In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
    Crítica · 9.8 CVE-2023-31047 >= 3.2, < 3.2.19, >= 4.0, < 4.1.9, >= 4.2, < 4.2.1 3.2.19, 4.1.9, 4.2.1
  22. An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f
    Alta · 7.5 CVE-2023-24580 >= 3.2, < 3.2.18, >= 4.0, < 4.0.10, >= 4.1, < 4.1.7 3.2.18, 4.0.10, 4.1.7
  23. In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s
    Alta · 7.5 CVE-2023-23969 >= 3.2, < 3.2.17, >= 4.0, < 4.0.9, >= 4.1, < 4.1.6 3.2.17, 4.0.9, 4.1.6
  24. In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular
    Alta · 7.5 CVE-2022-41323 >= 3.2, < 3.2.16, >= 4.0, < 4.0.8, >= 4.1, < 4.1.2 3.2.16, 4.0.8, 4.1.2
  25. Django vulnerable to Reflected File Download attack
    Alta · 8.8 CVE-2022-36359 < 3.2.15, >= 4.0, < 4.0.7 3.2.15, 4.0.7
  26. Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
    Crítica · 9.8 CVE-2022-34265 >= 3.2a1, < 3.2.14, >= 4.0a1, < 4.0.6 3.2.14, 4.0.6
  27. Django Arbitrary Code Execution
    Alta CVE-2007-0404 >= 0.95, < 1.0 1.0
  28. SQL Injection in Django
    Crítica · 9.8 CVE-2022-28347 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  29. SQL Injection in Django
    Crítica · 9.8 CVE-2022-28346 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  30. Infinite Loop in Django
    Alta · 7.5 CVE-2022-23833 >= 2.2, < 2.2.27, >= 3.2, < 3.2.12, >= 4.0, < 4.0.2 2.2.27, 3.2.12, 4.0.2
  31. Information disclosure in Django
    Alta · 7.5 CVE-2021-45116 >= 2.2, < 2.2.26, >= 3.2, < 3.2.11, >= 4.0, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  32. Denial-of-service in Django
    Alta · 7.5 CVE-2021-45115 >= 2.2a1, < 2.2.26, >= 3.2a1, < 3.2.11, >= 4.0a1, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  33. SQL Injection in Django
    Crítica · 9.8 CVE-2021-35042 >= 3.2a1, < 3.2.5, >= 3.0a1, < 3.1.13 3.2.5, 3.1.13
  34. Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
    Alta · 7.5 CVE-2021-33571 >= 2.2a1, < 2.2.24, >= 3.0a1, < 3.1.12, >= 3.2a1, < 3.2.4 2.2.24, 3.1.12, 3.2.4
  35. Path Traversal in Django
    Alta · 7.5 CVE-2021-31542 >= 2.2, < 2.2.21, >= 3.0, < 3.1.9, >= 3.2, < 3.2.1 2.2.21, 3.1.9, 3.2.1
  36. Django Incorrect Default Permissions
    Alta · 7.5 CVE-2020-24583 >= 2.2a1, < 2.2.16, >= 3.0a1, < 3.0.10, >= 3.1a1, < 3.1.1 2.2.16, 3.0.10, 3.1.1
  37. Data leakage via cache key collision in Django
    Alta · 5.9 CVE-2020-13254 >= 2.2, < 2.2.13, >= 3.0, < 3.0.7 2.2.13, 3.0.7
  38. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suit
    Alta · 8.8 CVE-2020-9402 >= 1.11, < 1.11.29, >= 2.2, < 2.2.11, >= 3.0, < 3.0.4 1.11.29, 2.2.11, 3.0.4
  39. SQL injection in Django
    Crítica · 9.8 CVE-2020-7471 < 1.11.28, >= 2.0, < 2.2.10, >= 3.0, < 3.0.3 1.11.28, 2.2.10, 3.0.3
  40. Django Potential account hijack via password reset form
    Crítica · 9.8 CVE-2019-19844 < 1.11.27, >= 2.0, < 2.2.9, >= 3.0, < 3.0.1 1.11.27, 2.2.9, 3.0.1
  41. Django allows unintended model editing
    Alta · 6.5 CVE-2019-19118 >= 2.1, < 2.1.15, >= 2.2, < 2.2.8 2.1.15, 2.2.8
  42. SQL Injection in Django
    Crítica · 9.8 CVE-2019-14234 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  43. Uncontrolled Recursion in Django
    Alta · 7.5 CVE-2019-14235 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  44. Django Denial-of-service in strip_tags()
    Alta · 7.5 CVE-2019-14233 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  45. Django Denial-of-service in django.utils.text.Truncator
    Alta · 7.5 CVE-2019-14232 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  46. Uncontrolled Memory Consumption in Django
    Alta · 7.5 CVE-2019-6975 >= 1.11, < 1.11.19, >= 2.0, < 2.0.11, >= 2.1, < 2.1.6 1.11.19, 2.0.11, 2.1.6
  47. Improper Input Validation in Django
    Alta · 6.5 CVE-2019-3498 >= 1.11a1, < 1.11.18, >= 2.0a1, < 2.0.10, >= 2.1a1, < 2.1.5 1.11.18, 2.0.10, 2.1.5
  48. Django vulnerable to information leakage in AuthenticationForm
    Alta · 7.5 CVE-2018-6188 >= 2.0a1, < 2.0.2, >= 1.11.8, < 1.11.10 2.0.2, 1.11.10
  49. Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate
    Crítica · 8.1 CVE-2016-9014 < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3 1.8.16, 1.9.11, 1.10.3
  50. Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easi
    Crítica · 9.8 CVE-2016-9013 >= 1.8, < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3 1.8.16, 1.9.11, 1.10.3
  51. The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a
    Alta · 7.5 CVE-2016-7401 < 1.8.15, >= 1.9, < 1.9.10 1.8.15, 1.9.10
  52. Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option w
    Alta · 5.5 CVE-2016-2048 >= 1.9, < 1.9.2 1.9.2
  53. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP r
    Alta · 7.5 CVE-2015-5144 < 1.4.21, >= 1.5, < 1.7.9, >= 1.8, < 1.8.3 1.4.21, 1.7.9, 1.8.3
  54. validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
    Alta · 7.5 CVE-2015-5145 >= 1.8, < 1.8.3 1.8.3
  55. Django Denial-of-service by filling session store
    Alta · 7.5 CVE-2015-5143 < 1.4.21, >= 1.5, < 1.7.9, >= 1.8, < 1.8.3 1.4.21, 1.7.9, 1.8.3
  56. The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of servic
    Alta · 7.5 CVE-2015-2316 >= 1.6, < 1.6.11, >= 1.7, < 1.7.7, >= 1.8a0, < 1.8c1 1.6.11, 1.7.7, 1.8c1
  57. The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service
    Alta · 7.5 CVE-2015-0221 < 1.4.18, >= 1.5, < 1.6.10, >= 1.7, < 1.7.3 1.4.18, 1.6.10, 1.7.3
  58. ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate val
    Alta · 7.5 CVE-2015-0222 < 1.4.18, >= 1.5, < 1.6.10, >= 1.7, < 1.7.3 1.4.18, 1.6.10, 1.7.3
  59. The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation
    Alta · 7.5 CVE-2014-0481 < 1.4.14, >= 1.5, < 1.5.9, >= 1.6, < 1.6.6 1.4.14, 1.5.9, 1.6.6
  60. The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attacker
    Alta · 7.5 CVE-2014-0480 < 1.4.14, >= 1.5, < 1.5.9, >= 1.6, < 1.6.6 1.4.14, 1.5.9, 1.6.6
  61. The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduc
    Alta · 7.5 CVE-2014-3730 >= 1.4, < 1.4.13, >= 1.5, < 1.5.8, >= 1.6, < 1.6.5, >= 1.7a0, < 1.7b4 1.4.13, 1.5.8, 1.6.5, 1.7b4
  62. Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attacker
    Crítica · 7.4 CVE-2014-1418 >= 1.4, < 1.4.13, >= 1.5, < 1.5.8, >= 1.6, < 1.6.5, >= 1.7a0, < 1.7b4 1.4.13, 1.5.8, 1.6.5, 1.7b4
  63. The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Pytho
    Crítica · 9.8 CVE-2014-0472 < 1.4.11, >= 1.5, < 1.5.6, >= 1.6, < 1.6.3 1.4.11, 1.5.6, 1.6.3
  64. The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properl
    Alta · 9.8 CVE-2014-0474 < 1.4.11, >= 1.5, < 1.5.6, >= 1.6, < 1.6.3 1.4.11, 1.5.6, 1.6.3
  65. The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to
    Alta · 7.5 CVE-2014-0473 < 1.4.11, >= 1.5, < 1.5.6, >= 1.6, < 1.6.3 1.4.11, 1.5.6, 1.6.3
  66. The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption)
    Alta · 7.5 CVE-2013-1443 >= 1.4, < 1.4.8, >= 1.5, < 1.5.4 1.4.8, 1.5.4
  67. Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_R
    Alta · 8.6 CVE-2013-4315 >= 1.4, < 1.4.7, >= 1.5, < 1.5.3 1.4.7, 1.5.3
  68. The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host
    Alta · 7.5 CVE-2012-4520 >= 1.3, < 1.3.4, >= 1.4, < 1.4.2 1.3.4, 1.4.2
  69. The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which
    Crítica · 6.1 CVE-2012-3442 < 1.3.2, >= 1.4, < 1.4.1 1.3.2, 1.4.1
  70. The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a
    Alta · 7.5 CVE-2012-3443 < 1.3.2, >= 1.4, < 1.4.1 1.3.2, 1.4.1
  71. The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows rem
    Alta · 7.5 CVE-2012-3444 < 1.3.2, >= 1.4, < 1.4.1 1.3.2, 1.4.1
  72. The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for t
    Alta · 7.5 CVE-2011-4138 < 1.2.7, >= 1.3, < 1.3.1 1.2.7, 1.3.1
  73. Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a cr
    Alta · 7.5 CVE-2011-4139 < 1.2.7, >= 1.3, < 1.3.1 1.2.7, 1.3.1
  74. Django Cross-Site Request Forgery vulnerability
    Alta · 7.5 CVE-2011-4140 <= 1.2.7, >= 1.3, <= 1.3.1 sin corrección
  75. Denial of service in django
    Alta · 7.5 CVE-2011-4137 < 1.2.7, >= 1.3, < 1.3.1 1.2.7, 1.3.1
  76. Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site requ
    Alta · 7.5 CVE-2011-0696 >= 1.1, < 1.1.4, >= 1.2, < 1.2.5 1.1.4, 1.2.5
  77. Directory traversal in Django
    Crítica · 9.1 CVE-2011-0698 >= 1.1, < 1.1.4, >= 1.2, < 1.2.5 1.1.4, 1.2.5
  78. The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain objec
    Alta · 6.5 CVE-2010-4534 < 1.1.3, >= 1.2, < 1.2.4 1.1.3, 1.2.4
  79. Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) Email
    Alta · 7.5 CVE-2009-3695 >= 1.0, < 1.0.4, >= 1.1, < 1.1.1 1.0.4, 1.1.1
  80. The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory trave
    Alta · 7.5 CVE-2009-2659 < 1.1 1.1
  81. The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to cond
    Alta · 7.5 CVE-2008-3909 < 1.1 1.1
  82. The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows rem
    Alta · 5.9 CVE-2007-5712 < 1.1 1.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.