DJ
Product
Django
161
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 13High 46Medium 51Low 5
Watch
Add Django to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-4138 | – | Oct 19 | The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then… Affected: through 1.2.6; 0.91; 0.95; 0.95.1; 0.96; 1.0; +16 more |
| CVE-2011-4137 | – | Oct 19 | The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL… Affected: through 1.2.6; 0.91; 0.95; 0.95.1; 0.96; 1.0; +16 more |
| CVE-2011-4136 | – | Oct 19 | django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and… Affected: through 1.2.6; 0.91; 0.95; 0.95.1; 0.96; 1.0; +16 more |
| CVE-2011-0697 | – | Feb 14 | Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename… Affected: 1.1; 1.1.0; 1.1.2; 1.1.3; 1.2; 1.2.1; +3 more |
| CVE-2011-0698 | – | Feb 14 | Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in… Affected: 1.1; 1.1.0; 1.1.2; 1.1.3; 1.2; 1.2.1; +3 more |
| CVE-2011-0696 | – | Feb 14 | Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to… Affected: 1.1; 1.1.0; 1.1.2; 1.1.3; 1.2; 1.2.1; +3 more |
| CVE-2010-4534 | – | Jan 10 | The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to… Affected: through 1.1.2; 0.91; 0.95; 0.95.1; 0.96; 1.0; +10 more |
| CVE-2010-4535 | – | Jan 10 | The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string… Affected: through 1.1.2; 0.91; 0.95; 0.95.1; 0.96; 1.0; +10 more |
| CVE-2010-3082 | – | Sep 14 | Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token)… Affected: 1.2.1; 1.2.1; 1.2.2 |
| CVE-2009-3695 | – | Oct 13 | Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption)… Affected: 1.0; 1.1 |
| CVE-2008-3909 | – | Sep 4 | The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows… Affected: 0.91 before 0.91.3; 0.95 before 0.95.4; 0.96 before 0.96.3 |