Published: 23/04/2014 Updated: 07/01/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django prior to 1.4.11, 1.5.x prior to 1.5.6, 1.6.x prior to 1.6.3, and 1.7.x prior to 1.7 beta 2 do not properly perform type conversion, which allows remote malicious users to have unspecified impact and vectors, related to "MySQL typecasting."

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 10.04
canonical ubuntu linux 14.04
canonical ubuntu linux 13.10
canonical ubuntu linux 12.04
canonical ubuntu linux 12.10
djangoproject django 1.6
djangoproject django 1.6.2
djangoproject django 1.6.1
djangoproject django 1.4.5
djangoproject django 1.4.6
djangoproject django 1.4.9
djangoproject django 1.4
djangoproject django 1.4.1
djangoproject django 1.4.2
djangoproject django 1.4.4
djangoproject django 1.4.3
djangoproject django
djangoproject django 1.4.7
djangoproject django 1.4.8
djangoproject django 1.7
djangoproject django 1.5.5
djangoproject django 1.5.2
djangoproject django 1.5.1
djangoproject django 1.5
djangoproject django 1.5.4
djangoproject django 1.5.3

Several security issues were fixed in Django ...

USN-2169-1 introduced a regression in Django ...

Several vulnerabilities were discovered in Django, a high-level Python web development framework The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0472 Benjamin Bach discovered that Django incorrectly handled dotted Python paths when using the reverse() URL resolver function An attacker able ...

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1411, 15x before 156, 16x before 163, and 17x before 17 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting" ...

Code for sql injection in django.

Django-sql-injection What is SQL Injection? SQL injection is a vulnerability in which malicious data is injected into the application and sent to a SQL database as part of a SQL query and the database executes the malicious query Eg Consider a login form with the below SQL statement: SELECT * FROM users WHERE username = ‘$user’ AND password = ‘$password&rsq

CWE-399 https://www.djangoproject.com/weblog/2014/apr/21/security/http://www.ubuntu.com/usn/USN-2169-1 http://rhn.redhat.com/errata/RHSA-2014-0457.html http://www.debian.org/security/2014/dsa-2934 http://rhn.redhat.com/errata/RHSA-2014-0456.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00023.html http://secunia.com/advisories/61281 https://nvd.nist.gov https://usn.ubuntu.com/2169-1/https://access.redhat.com/security/cve/cve-2014-0474

CVE-2014-0474

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect