Zaloguj się
Deutsch English Español Polski
Wysoka

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

  • Ujawniono: 05.11.2025
  • Aktualizacja: 11.10.2026 15:17

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Seokchan Yoon for reporting this issue.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Python (PyPI) django >= 5.2a1, < 5.2.8, >= 5.0a1, < 5.1.14, < 4.2.26 5.2.8, 5.1.14, 4.2.26

Odnośniki

Ocena CVSS 7.5/10
Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Słabość (CWE)
CWE-407
Platforma
Python (PyPI)
Paczka
django
Ujawniono
05.11.2025
Aktualizacja
11.10.2026 15:17

Źródła i licencje

OSV / GitHub Advisory Database - PYSEC-2025-107 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-qw25-v68c-qjf3 - CC BY 4.0

Historia podatności: django

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (162) w archiwum
Wszystkich wpisów
162
Pierwsza → ostatnia
10.2007 08.2026
Bez poprawki
1
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 16
  • Wysoka 65
  • Średnia 63
  • Niska 18

Ujawnienia w latach

wcześniej: 56

Istotność:
  1. Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
    Wysoka · 8.8 CVE-2026-15307 < 5.2.17, >= 6.0a1, < 6.0.8 5.2.17, 6.0.8
  2. Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
    Wysoka · 7.5 CVE-2026-3902 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  3. Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
    Wysoka · 7.5 CVE-2026-33034 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  4. Django vulnerable to Uncontrolled Resource Consumption
    Wysoka · 7.5 CVE-2026-25673 >= 6.0, < 6.0.3, >= 5.2, < 5.2.12, >= 4.2, < 4.2.29 6.0.3, 5.2.12, 4.2.29
  5. Django has an SQL Injection issue
    Wysoka CVE-2026-1287 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  6. Django has an SQL Injection issue
    Wysoka CVE-2026-1207 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  7. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
    Krytyczna · 9.1 CVE-2025-64459 >= 4.2, < 4.2.26, >= 5.1, < 5.1.14, >= 5.2, < 5.2.8 4.2.26, 5.1.14, 5.2.8
  8. Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows ten wpis
    Wysoka · 7.5 CVE-2025-64458 >= 5.2a1, < 5.2.8, >= 5.0a1, < 5.1.14, < 4.2.26 5.2.8, 5.1.14, 4.2.26
  9. Django vulnerable to SQL injection in column aliases
    Wysoka · 7.1 CVE-2025-59681 >= 4.2, < 4.2.25, >= 5.1, < 5.1.13, >= 5.2, < 5.2.7 4.2.25, 5.1.13, 5.2.7
  10. Django is subject to SQL injection through its column aliases
    Wysoka · 7.1 CVE-2025-57833 < 4.2.24, >= 5.0a1, < 5.1.12, >= 5.2a1, < 5.2.6 4.2.24, 5.1.12, 5.2.6
  11. Django SQL injection in HasKey(lhs, rhs) on Oracle
    Wysoka · 9.8 CVE-2024-53908 >= 5.0.0, < 5.0.10, >= 5.1.0, < 5.1.4, >= 4.2.0, < 4.2.17, >= 5.1, < 5.1.4, >= 5.0, < 5.0.10, >= 4.2, < 4.2.17 5.0.10, 5.1.4, 4.2.17
  12. An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a cr
    Krytyczna · 9.1 CVE-2024-42005 >= 5.0, < 5.0.8, >= 4.2, < 4.2.15 5.0.8, 4.2.15
  13. Django vulnerable to Denial of Service
    Wysoka · 7.5 CVE-2024-39614 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  14. Django Path Traversal vulnerability
    Wysoka · 7.5 CVE-2024-39330 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  15. Django vulnerable to Denial of Service
    Wysoka · 7.5 CVE-2024-38875 >= 4.2, < 4.2.14, >= 5.0, < 5.0.7 4.2.14, 5.0.7
  16. Django denial-of-service attack in the intcomma template filter
    Wysoka · 5.9 CVE-2024-24680 >= 3.2, < 3.2.24, >= 4.2, < 4.2.10, >= 5.0, < 5.0.2 3.2.24, 4.2.10, 5.0.2
  17. In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
    Wysoka · 5.9 CVE-2023-43665 >= 3.2, < 3.2.22, >= 4.1, < 4.1.12, >= 4.2, < 4.2.6 3.2.22, 4.1.12, 4.2.6
  18. An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
    Wysoka · 7.5 CVE-2023-46695 >= 3.2, < 3.2.23, >= 4.1, < 4.1.13, >= 4.2, < 4.2.7 3.2.23, 4.1.13, 4.2.7
  19. In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
    Wysoka · 7.5 CVE-2023-36053 >= 4.2, < 4.2.3, >= 4.0, < 4.1.10, >= 3.2, < 3.2.20 4.2.3, 4.1.10, 3.2.20
  20. In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
    Krytyczna · 9.8 CVE-2023-31047 >= 3.2, < 3.2.19, >= 4.0, < 4.1.9, >= 4.2, < 4.2.1 3.2.19, 4.1.9, 4.2.1
  21. An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f
    Wysoka · 7.5 CVE-2023-24580 >= 3.2, < 3.2.18, >= 4.0, < 4.0.10, >= 4.1, < 4.1.7 3.2.18, 4.0.10, 4.1.7
  22. In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s
    Wysoka · 7.5 CVE-2023-23969 >= 3.2, < 3.2.17, >= 4.0, < 4.0.9, >= 4.1, < 4.1.6 3.2.17, 4.0.9, 4.1.6
  23. In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular
    Wysoka · 7.5 CVE-2022-41323 >= 3.2, < 3.2.16, >= 4.0, < 4.0.8, >= 4.1, < 4.1.2 3.2.16, 4.0.8, 4.1.2
  24. Django vulnerable to Reflected File Download attack
    Wysoka · 8.8 CVE-2022-36359 < 3.2.15, >= 4.0, < 4.0.7 3.2.15, 4.0.7
  25. Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
    Krytyczna · 9.8 CVE-2022-34265 >= 3.2a1, < 3.2.14, >= 4.0a1, < 4.0.6 3.2.14, 4.0.6
  26. Django Arbitrary Code Execution
    Wysoka CVE-2007-0404 >= 0.95, < 1.0 1.0
  27. SQL Injection in Django
    Krytyczna · 9.8 CVE-2022-28347 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  28. SQL Injection in Django
    Krytyczna · 9.8 CVE-2022-28346 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  29. Infinite Loop in Django
    Wysoka · 7.5 CVE-2022-23833 >= 2.2, < 2.2.27, >= 3.2, < 3.2.12, >= 4.0, < 4.0.2 2.2.27, 3.2.12, 4.0.2
  30. Information disclosure in Django
    Wysoka · 7.5 CVE-2021-45116 >= 2.2, < 2.2.26, >= 3.2, < 3.2.11, >= 4.0, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  31. Denial-of-service in Django
    Wysoka · 7.5 CVE-2021-45115 >= 2.2a1, < 2.2.26, >= 3.2a1, < 3.2.11, >= 4.0a1, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  32. SQL Injection in Django
    Krytyczna · 9.8 CVE-2021-35042 >= 3.2a1, < 3.2.5, >= 3.0a1, < 3.1.13 3.2.5, 3.1.13
  33. Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
    Wysoka · 7.5 CVE-2021-33571 >= 2.2a1, < 2.2.24, >= 3.0a1, < 3.1.12, >= 3.2a1, < 3.2.4 2.2.24, 3.1.12, 3.2.4
  34. Path Traversal in Django
    Wysoka · 7.5 CVE-2021-31542 >= 2.2, < 2.2.21, >= 3.0, < 3.1.9, >= 3.2, < 3.2.1 2.2.21, 3.1.9, 3.2.1
  35. Django Incorrect Default Permissions
    Wysoka · 7.5 CVE-2020-24583 >= 2.2a1, < 2.2.16, >= 3.0a1, < 3.0.10, >= 3.1a1, < 3.1.1 2.2.16, 3.0.10, 3.1.1
  36. Data leakage via cache key collision in Django
    Wysoka · 5.9 CVE-2020-13254 >= 2.2, < 2.2.13, >= 3.0, < 3.0.7 2.2.13, 3.0.7
  37. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suit
    Wysoka · 8.8 CVE-2020-9402 >= 1.11, < 1.11.29, >= 2.2, < 2.2.11, >= 3.0, < 3.0.4 1.11.29, 2.2.11, 3.0.4
  38. SQL injection in Django
    Krytyczna · 9.8 CVE-2020-7471 < 1.11.28, >= 2.0, < 2.2.10, >= 3.0, < 3.0.3 1.11.28, 2.2.10, 3.0.3
  39. Django Potential account hijack via password reset form
    Krytyczna · 9.8 CVE-2019-19844 < 1.11.27, >= 2.0, < 2.2.9, >= 3.0, < 3.0.1 1.11.27, 2.2.9, 3.0.1
  40. Django allows unintended model editing
    Wysoka · 6.5 CVE-2019-19118 >= 2.1, < 2.1.15, >= 2.2, < 2.2.8 2.1.15, 2.2.8
  41. SQL Injection in Django
    Krytyczna · 9.8 CVE-2019-14234 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  42. Uncontrolled Recursion in Django
    Wysoka · 7.5 CVE-2019-14235 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  43. Django Denial-of-service in strip_tags()
    Wysoka · 7.5 CVE-2019-14233 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  44. Django Denial-of-service in django.utils.text.Truncator
    Wysoka · 7.5 CVE-2019-14232 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  45. Uncontrolled Memory Consumption in Django
    Wysoka · 7.5 CVE-2019-6975 >= 1.11, < 1.11.19, >= 2.0, < 2.0.11, >= 2.1, < 2.1.6 1.11.19, 2.0.11, 2.1.6
  46. Improper Input Validation in Django
    Wysoka · 6.5 CVE-2019-3498 >= 1.11a1, < 1.11.18, >= 2.0a1, < 2.0.10, >= 2.1a1, < 2.1.5 1.11.18, 2.0.10, 2.1.5
  47. Django vulnerable to information leakage in AuthenticationForm
    Wysoka · 7.5 CVE-2018-6188 >= 2.0a1, < 2.0.2, >= 1.11.8, < 1.11.10 2.0.2, 1.11.10
  48. Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate
    Krytyczna · 8.1 CVE-2016-9014 < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3 1.8.16, 1.9.11, 1.10.3
  49. Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easi
    Krytyczna · 9.8 CVE-2016-9013 >= 1.8, < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3 1.8.16, 1.9.11, 1.10.3
  50. The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a
    Wysoka · 7.5 CVE-2016-7401 < 1.8.15, >= 1.9, < 1.9.10 1.8.15, 1.9.10
  51. Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option w
    Wysoka · 5.5 CVE-2016-2048 >= 1.9, < 1.9.2 1.9.2
  52. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP r
    Wysoka · 7.5 CVE-2015-5144 < 1.4.21, >= 1.5, < 1.7.9, >= 1.8, < 1.8.3 1.4.21, 1.7.9, 1.8.3
  53. validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
    Wysoka · 7.5 CVE-2015-5145 >= 1.8, < 1.8.3 1.8.3
  54. Django Denial-of-service by filling session store
    Wysoka · 7.5 CVE-2015-5143 < 1.4.21, >= 1.5, < 1.7.9, >= 1.8, < 1.8.3 1.4.21, 1.7.9, 1.8.3
  55. The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of servic
    Wysoka · 7.5 CVE-2015-2316 >= 1.6, < 1.6.11, >= 1.7, < 1.7.7, >= 1.8a0, < 1.8c1 1.6.11, 1.7.7, 1.8c1
  56. The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service
    Wysoka · 7.5 CVE-2015-0221 < 1.4.18, >= 1.5, < 1.6.10, >= 1.7, < 1.7.3 1.4.18, 1.6.10, 1.7.3
  57. ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate val
    Wysoka · 7.5 CVE-2015-0222 < 1.4.18, >= 1.5, < 1.6.10, >= 1.7, < 1.7.3 1.4.18, 1.6.10, 1.7.3
  58. The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation
    Wysoka · 7.5 CVE-2014-0481 < 1.4.14, >= 1.5, < 1.5.9, >= 1.6, < 1.6.6 1.4.14, 1.5.9, 1.6.6
  59. The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attacker
    Wysoka · 7.5 CVE-2014-0480 < 1.4.14, >= 1.5, < 1.5.9, >= 1.6, < 1.6.6 1.4.14, 1.5.9, 1.6.6
  60. The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduc
    Wysoka · 7.5 CVE-2014-3730 >= 1.4, < 1.4.13, >= 1.5, < 1.5.8, >= 1.6, < 1.6.5, >= 1.7a0, < 1.7b4 1.4.13, 1.5.8, 1.6.5, 1.7b4
  61. Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attacker
    Krytyczna · 7.4 CVE-2014-1418 >= 1.4, < 1.4.13, >= 1.5, < 1.5.8, >= 1.6, < 1.6.5, >= 1.7a0, < 1.7b4 1.4.13, 1.5.8, 1.6.5, 1.7b4
  62. The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Pytho
    Krytyczna · 9.8 CVE-2014-0472 < 1.4.11, >= 1.5, < 1.5.6, >= 1.6, < 1.6.3 1.4.11, 1.5.6, 1.6.3
  63. The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properl
    Wysoka · 9.8 CVE-2014-0474 < 1.4.11, >= 1.5, < 1.5.6, >= 1.6, < 1.6.3 1.4.11, 1.5.6, 1.6.3
  64. The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to
    Wysoka · 7.5 CVE-2014-0473 < 1.4.11, >= 1.5, < 1.5.6, >= 1.6, < 1.6.3 1.4.11, 1.5.6, 1.6.3
  65. The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption)
    Wysoka · 7.5 CVE-2013-1443 >= 1.4, < 1.4.8, >= 1.5, < 1.5.4 1.4.8, 1.5.4
  66. Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_R
    Wysoka · 8.6 CVE-2013-4315 >= 1.4, < 1.4.7, >= 1.5, < 1.5.3 1.4.7, 1.5.3
  67. The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host
    Wysoka · 7.5 CVE-2012-4520 >= 1.3, < 1.3.4, >= 1.4, < 1.4.2 1.3.4, 1.4.2
  68. The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which
    Krytyczna · 6.1 CVE-2012-3442 < 1.3.2, >= 1.4, < 1.4.1 1.3.2, 1.4.1
  69. The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a
    Wysoka · 7.5 CVE-2012-3443 < 1.3.2, >= 1.4, < 1.4.1 1.3.2, 1.4.1
  70. The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows rem
    Wysoka · 7.5 CVE-2012-3444 < 1.3.2, >= 1.4, < 1.4.1 1.3.2, 1.4.1
  71. The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for t
    Wysoka · 7.5 CVE-2011-4138 < 1.2.7, >= 1.3, < 1.3.1 1.2.7, 1.3.1
  72. Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a cr
    Wysoka · 7.5 CVE-2011-4139 < 1.2.7, >= 1.3, < 1.3.1 1.2.7, 1.3.1
  73. Django Cross-Site Request Forgery vulnerability
    Wysoka · 7.5 CVE-2011-4140 <= 1.2.7, >= 1.3, <= 1.3.1 brak poprawki
  74. Denial of service in django
    Wysoka · 7.5 CVE-2011-4137 < 1.2.7, >= 1.3, < 1.3.1 1.2.7, 1.3.1
  75. Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site requ
    Wysoka · 7.5 CVE-2011-0696 >= 1.1, < 1.1.4, >= 1.2, < 1.2.5 1.1.4, 1.2.5
  76. Directory traversal in Django
    Krytyczna · 9.1 CVE-2011-0698 >= 1.1, < 1.1.4, >= 1.2, < 1.2.5 1.1.4, 1.2.5
  77. The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain objec
    Wysoka · 6.5 CVE-2010-4534 < 1.1.3, >= 1.2, < 1.2.4 1.1.3, 1.2.4
  78. Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) Email
    Wysoka · 7.5 CVE-2009-3695 >= 1.0, < 1.0.4, >= 1.1, < 1.1.1 1.0.4, 1.1.1
  79. The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory trave
    Wysoka · 7.5 CVE-2009-2659 < 1.1 1.1
  80. The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to cond
    Wysoka · 7.5 CVE-2008-3909 < 1.1 1.1
  81. The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows rem
    Wysoka · 5.9 CVE-2007-5712 < 1.1 1.1

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.