Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
djangoproject django vulnerabilities and exploits
(subscribe to this query)
445
VMScore
CVE-2015-3982
The session.flush function in the cached_db backend in Django 1.8.x prior to 1.8.2 does not properly flush the session, which allows remote malicious users to hijack user sessions via an empty string in the session key.
Djangoproject Django 1.8.0
Djangoproject Django 1.8.1
445
VMScore
CVE-2015-2316
The utils.html.strip_tags function in Django 1.6.x prior to 1.6.11, 1.7.x prior to 1.7.7, and 1.8.x prior to 1.8c1, when using certain versions of Python, allows remote malicious users to cause a denial of service (infinite loop) by increasing the length of the input string.
Oracle Solaris 11.2
Djangoproject Django 1.6.10
Djangoproject Django 1.6.2
Djangoproject Django 1.6.1
Djangoproject Django 1.7
Djangoproject Django 1.7.3
Djangoproject Django 1.7.4
Djangoproject Django 1.6.4
Djangoproject Django 1.6.3
Djangoproject Django 1.6
Djangoproject Django 1.7.1
Djangoproject Django 1.7.2
Djangoproject Django 1.6.7
Djangoproject Django 1.6.6
Djangoproject Django 1.6.5
Djangoproject Django 1.6.9
Djangoproject Django 1.6.8
Djangoproject Django 1.7.5
Djangoproject Django 1.7.6
Djangoproject Django 1.8.0
Canonical Ubuntu Linux 10.04
Canonical Ubuntu Linux 12.04
445
VMScore
CVE-2015-0222
ModelMultipleChoiceField in Django 1.6.x prior to 1.6.10 and 1.7.x prior to 1.7.3, when show_hidden_initial is set to True, allows remote malicious users to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.
Canonical Ubuntu Linux 14.04
Canonical Ubuntu Linux 12.04
Canonical Ubuntu Linux 10.04
Canonical Ubuntu Linux 14.10
Djangoproject Django 1.6.4
Djangoproject Django 1.6.5
Djangoproject Django 1.7.2
Djangoproject Django 1.6
Djangoproject Django 1.6.1
Djangoproject Django 1.6.8
Djangoproject Django 1.6.9
Djangoproject Django 1.6.2
Djangoproject Django 1.6.3
Djangoproject Django 1.7
Djangoproject Django 1.7.1
Djangoproject Django
Djangoproject Django 1.6.6
Djangoproject Django 1.6.7
445
VMScore
CVE-2015-0219
Django prior to 1.4.18, 1.6.x prior to 1.6.10, and 1.7.x prior to 1.7.3 allows remote malicious users to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.
Djangoproject Django 1.6.1
Djangoproject Django 1.6.2
Djangoproject Django 1.6.9
Djangoproject Django 1.7
Djangoproject Django 1.6.5
Djangoproject Django 1.6.6
Djangoproject Django
Djangoproject Django 1.6
Djangoproject Django 1.6.7
Djangoproject Django 1.6.8
Djangoproject Django 1.6.3
Djangoproject Django 1.6.4
Djangoproject Django 1.7.1
Djangoproject Django 1.7.2
445
VMScore
CVE-2015-0221
The django.views.static.serve view in Django prior to 1.4.18, 1.6.x prior to 1.6.10, and 1.7.x prior to 1.7.3 reads files an entire line at a time, which allows remote malicious users to cause a denial of service (memory consumption) via a long line in a file.
Djangoproject Django 1.6.4
Djangoproject Django 1.6.5
Djangoproject Django 1.7.2
Djangoproject Django 1.6
Djangoproject Django 1.6.1
Djangoproject Django 1.6.8
Djangoproject Django 1.6.9
Djangoproject Django 1.6.2
Djangoproject Django 1.6.3
Djangoproject Django 1.7
Djangoproject Django 1.7.1
Djangoproject Django
Djangoproject Django 1.6.6
Djangoproject Django 1.6.7
Canonical Ubuntu Linux 12.04
Canonical Ubuntu Linux 10.04
Canonical Ubuntu Linux 14.10
Canonical Ubuntu Linux 14.04
445
VMScore
CVE-2013-1443
The authentication framework (django.contrib.auth) in Django 1.4.x prior to 1.4.8, 1.5.x prior to 1.5.4, and 1.6.x prior to 1.6 beta 4 allows remote malicious users to cause a denial of service (CPU consumption) via a long password which is then hashed.
Djangoproject Django 1.4.5
Djangoproject Django 1.4.6
Djangoproject Django 1.4
Djangoproject Django 1.4.1
Djangoproject Django 1.4.2
Djangoproject Django 1.4.4
Djangoproject Django 1.4.7
Djangoproject Django 1.6
Djangoproject Django 1.5
Djangoproject Django 1.5.3
Djangoproject Django 1.5.1
Djangoproject Django 1.5.2
445
VMScore
CVE-2013-0306
The form library in Django 1.3.x prior to 1.3.6, 1.4.x prior to 1.4.4, and 1.5 before release candidate 2 allows remote malicious users to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_n...
Djangoproject Django 1.3.2
Djangoproject Django 1.3.3
Djangoproject Django 1.3
Djangoproject Django 1.3.1
Djangoproject Django 1.4
Djangoproject Django 1.4.1
Djangoproject Django 1.4.2
Djangoproject Django 1.5
Canonical Ubuntu Linux 12.04
Canonical Ubuntu Linux 12.10
Canonical Ubuntu Linux 11.10
Canonical Ubuntu Linux 10.04
445
VMScore
CVE-2012-3443
The django.forms.ImageField class in the form system in Django prior to 1.3.2 and 1.4.x prior to 1.4.1 completely decompresses image data during image validation, which allows remote malicious users to cause a denial of service (memory consumption) by uploading an image file.
Djangoproject Django
Djangoproject Django 1.3
Djangoproject Django 1.2.6
Djangoproject Django 1.2.5
Djangoproject Django 1.1.4
Djangoproject Django 1.1.3
Djangoproject Django 1.0.1
Djangoproject Django 0.96
Djangoproject Django 1.2
Djangoproject Django 1.2.7
Djangoproject Django 1.1
Djangoproject Django 1.0
Djangoproject Django 1.0.2
Djangoproject Django 1.2.4
Djangoproject Django 1.2.2
Djangoproject Django 1.1.2
Djangoproject Django 0.95
Djangoproject Django 1.4
Djangoproject Django 1.2-alpha1
445
VMScore
CVE-2012-3444
The get_image_dimensions function in the image-handling functionality in Django prior to 1.3.2 and 1.4.x prior to 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote malicious users to cause a denial of service (process or thread consumpt...
Djangoproject Django 1.2
Djangoproject Django 1.2.2
Djangoproject Django 1.1
Djangoproject Django 1.0
Djangoproject Django 1.4
Djangoproject Django 1.3
Djangoproject Django 1.2.5
Djangoproject Django 1.2.4
Djangoproject Django 1.1.2
Djangoproject Django 0.96
Djangoproject Django 0.95
Djangoproject Django 1.2-alpha1
Djangoproject Django
Djangoproject Django 1.2.7
Djangoproject Django 1.2.6
Djangoproject Django 1.1.4
Djangoproject Django 1.1.3
Djangoproject Django 1.0.2
Djangoproject Django 1.0.1
445
VMScore
CVE-2011-4137
The verify_exists functionality in the URLField implementation in Django prior to 1.2.7 and 1.3.x prior to 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote malicious users to cause a denial of service (resource consumpt...
Djangoproject Django 0.91
Djangoproject Django 1.2.2
Djangoproject Django 1.0.1
Djangoproject Django 0.96
Djangoproject Django 1.2.1
Djangoproject Django 1.1.2
Djangoproject Django 1.0.2
Djangoproject Django
Djangoproject Django 0.95
Djangoproject Django 0.95.1
Djangoproject Django 1.2.3
Djangoproject Django 1.1.0
Djangoproject Django 1.2.4
Djangoproject Django 1.2.5
Djangoproject Django 1.1
Djangoproject Django 1.0
Djangoproject Django 1.3
Djangoproject Django 1.2
Djangoproject Django 1.1.3
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-7073
CVE-2024-5496
CVE-2024-5495
XPath injection
bypass
CVE-2024-30043
CVE-2024-24919
denial of service
CVE-2024-35468
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »