Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
django vulnerabilities and exploits
(subscribe to this query)
6.4
CVSSv2
CVE-2018-6596
webhooks/base.py in Anymail (aka django-anymail) prior to 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote malicious users to post arbitrary e-mail tracking events.
Django-anymail Project Django-anymail
Debian Debian Linux 9.0
6.4
CVSSv2
CVE-2014-1418
Django 1.4 prior to 1.4.13, 1.5 prior to 1.5.8, 1.6 prior to 1.6.5, and 1.7 prior to 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote malicious users to obtain sensitive information or poison the cache via a reques...
Djangoproject Django 1.7
Djangoproject Django 1.4.12
Djangoproject Django 1.4.2
Djangoproject Django 1.4.4
Djangoproject Django 1.4
Djangoproject Django 1.4.1
Djangoproject Django 1.4.7
Djangoproject Django 1.4.8
Djangoproject Django 1.4.5
Djangoproject Django 1.4.6
Djangoproject Django 1.4.10
Djangoproject Django 1.4.11
Djangoproject Django 1.4.9
Djangoproject Django 1.5.7
Djangoproject Django 1.5.6
Djangoproject Django 1.5.3
Djangoproject Django 1.5.4
Djangoproject Django 1.5
Djangoproject Django 1.5.5
Djangoproject Django 1.5.1
Djangoproject Django 1.5.2
Canonical Ubuntu Linux 12.04
6.4
CVSSv2
CVE-2012-4520
The django.http.HttpRequest.get_host function in Django 1.3.x prior to 1.3.4 and 1.4.x prior to 1.4.2 allows remote malicious users to generate and display arbitrary URLs via crafted username and password Host header values.
Djangoproject Django 1.3.2
Djangoproject Django 1.3.3
Djangoproject Django 1.3
Djangoproject Django 1.3.1
Djangoproject Django 1.4
Djangoproject Django 1.4.1
6
CVSSv2
CVE-2016-2048
Django 1.9.x prior to 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
Djangoproject Django 1.9
Djangoproject Django 1.9.1
6
CVSSv2
CVE-2014-0482
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django prior to 1.4.14, 1.5.x prior to 1.5.9, 1.6.x prior to 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web s...
Opensuse Opensuse 12.3
Opensuse Opensuse 13.1
Djangoproject Django 1.6
Djangoproject Django 1.6.1
Djangoproject Django 1.6.2
Djangoproject Django 1.6.3
Djangoproject Django 1.6.4
Djangoproject Django 1.6.5
Djangoproject Django 1.4
Djangoproject Django 1.4.1
Djangoproject Django 1.4.5
Djangoproject Django 1.4.6
Djangoproject Django 1.4.10
Djangoproject Django 1.4.11
Djangoproject Django 1.4.7
Djangoproject Django 1.4.8
Djangoproject Django 1.4.12
Djangoproject Django
Djangoproject Django 1.4.9
Djangoproject Django 1.4.2
Djangoproject Django 1.4.4
Djangoproject Django 1.7
5.8
CVSSv2
CVE-2020-35681
Django Channels 3.x prior to 3.0.3 allows remote malicious users to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate...
Djangoproject Channels
5.8
CVSSv2
CVE-2020-29565
An issue exists in OpenStack Horizon prior to 15.3.2, 16.x prior to 16.2.1, 17.x and 18.x prior to 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automat...
Openstack Horizon
Debian Debian Linux 10.0
5.8
CVSSv2
CVE-2020-10594
An issue exists in drf-jwt 1.15.x prior to 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt i...
Styria Django-rest-framework-json Web Tokens
5.8
CVSSv2
CVE-2018-14574
django.middleware.common.CommonMiddleware in Django 1.11.x prior to 1.11.15 and 2.0.x prior to 2.0.8 has an Open Redirect.
Djangoproject Django
Debian Debian Linux 9.0
Canonical Ubuntu Linux 18.04
5.8
CVSSv2
CVE-2017-7234
A maliciously crafted URL to a Django (1.10 prior to 1.10.7, 1.9 prior to 1.9.13, and 1.8 prior to 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
Djangoproject Django 1.8.2
Djangoproject Django 1.8.3
Djangoproject Django 1.8.10
Djangoproject Django 1.8.11
Djangoproject Django 1.8.0
Djangoproject Django 1.9.4
Djangoproject Django 1.9.5
Djangoproject Django 1.10.1
Djangoproject Django 1.10.2
Djangoproject Django 1.9
Djangoproject Django 1.9.1
Djangoproject Django 1.8.4
Djangoproject Django 1.8.5
Djangoproject Django 1.8.12
Djangoproject Django 1.8.13
Djangoproject Django 1.9.6
Djangoproject Django 1.9.7
Djangoproject Django 1.10.3
Djangoproject Django 1.10.4
Djangoproject Django 1.9.2
Djangoproject Django 1.9.8
Djangoproject Django 1.8.1
3 Github repositories
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-26925
CVE-2023-41826
LFI
CVE-2022-22364
CVE-2024-2887
command injection
remote code execution
CVE-2024-34446
CVE-2022-48699
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »