Arsip dari masalah keamananLink to this heading#

November 1, 2023 - CVE 2023-46695Link to this heading#

Potential denial of service vulnerability in UsernameField on Windows. Full description

• Django 4.2 (patch)

• Django 4.1 (patch)

• Django 3.2 (patch)

October 4, 2023 - CVE 2023-43665Link to this heading#

Denial-of-service possibility in django.utils.text.Truncator. Full description

• Django 4.2 (patch)

• Django 4.1 (patch)

• Django 3.2 (patch)

September 4, 2023 - CVE 2023-41164Link to this heading#

Potential denial of service vulnerability in django.utils.encoding.uri_to_iri(). Full description

• Django 4.2 (patch)

• Django 4.1 (patch)

• Django 3.2 (patch)

July 3, 2023 - CVE 2023-36053Link to this heading#

Potential regular expression denial of service vulnerability in EmailValidator/URLValidator. Full description

• Django 4.2 (patch)

• Django 4.1 (patch)

• Django 3.2 (patch)

May 3, 2023 - CVE 2023-31047Link to this heading#

Potential bypass of validation when uploading multiple files using one form field. Full description

• Django 4.2 (patch)

• Django 4.1 (patch)

• Django 3.2 (patch)

February 14, 2023 - CVE 2023-24580Link to this heading#

Potential denial-of-service vulnerability in file uploads. Full description

• Django 4.1 (patch)

• Django 4.0 (patch)

• Django 3.2 (patch)

February 1, 2023 - CVE 2023-23969Link to this heading#

Potential denial-of-service via Accept-Language headers. Full description

• Django 4.1 (patch)

• Django 4.0 (patch)

• Django 3.2 (patch)

October 4, 2022 - CVE 2022-41323Link to this heading#

Potential denial-of-service vulnerability in internationalized URLs. Full description

• Django 4.1 (patch)

• Django 4.0 (patch)

• Django 3.2 (patch)

August 3, 2022 - CVE 2022-36359Link to this heading#

Potential reflected file download vulnerability in FileResponse. Full description

• Django 4.0 (patch)

• Django 3.2 (patch)

July 4, 2022 - CVE 2022-34265Link to this heading#

Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments. Full description

• Django 4.0 (patch)

• Django 3.2 (patch)

April 11, 2022 - CVE 2022-28346Link to this heading#

Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description

• Django 4.0 (patch)

• Django 3.2 (patch)

• Django 2.2 (patch)

April 11, 2022 - CVE 2022-28347Link to this heading#

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description

• Django 4.0 (patch)

• Django 3.2 (patch)

• Django 2.2 (patch)

February 1, 2022 - CVE 2022-22818Link to this heading#

Possible XSS via {% debug %} template tag. Full description

February 1, 2022 - CVE 2022-23833Link to this heading#

Denial-of-service possibility in file uploads. Full description

January 4, 2022 - CVE 2021-45452Link to this heading#

Potential directory-traversal via Storage.save(). Full description

January 4, 2022 - CVE 2021-45116Link to this heading#

Potential information disclosure in dictsort template filter. Full description

January 4, 2022 - CVE 2021-45115Link to this heading#

Denial-of-service possibility in UserAttributeSimilarityValidator. Full description

December 7, 2021 - CVE 2021-44420Link to this heading#

Potential bypass of an upstream access control based on URL paths. Full description

July 1, 2021 - CVE 2021-35042Link to this heading#

Potential SQL injection via unsanitized QuerySet.order_by() input. Full description

June 2, 2021 - CVE 2021-33203Link to this heading#

Potential directory traversal via admindocs. Full description

June 2, 2021 - CVE 2021-33571Link to this heading#

Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses. Full description

May 6, 2021 - CVE 2021-32052Link to this heading#

Header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+. Full description

May 4, 2021 - CVE 2021-31542Link to this heading#

Potential directory-traversal via uploaded files. Full description

April 6, 2021 - CVE 2021-28658Link to this heading#

Potential directory-traversal via uploaded files. Full description

February 19, 2021 - CVE 2021-23336Link to this heading#

Web cache poisoning via django.utils.http.limited_parse_qsl(). Full description

February 1, 2021 - CVE 2021-3281Link to this heading#

Potential directory-traversal via archive.extract(). Full description

September 1, 2020 - CVE 2020-24584Link to this heading#

Permission escalation in intermediate-level directories of the file system cache on Python 3.7+. Full description

September 1, 2020 - CVE 2020-24583Link to this heading#

Incorrect permissions on intermediate-level directories on Python 3.7+. Full description

June 3, 2020 - CVE 2020-13596Link to this heading#

Possible XSS via admin ForeignKeyRawIdWidget. Full description

June 3, 2020 - CVE 2020-13254Link to this heading#

Potential data leakage via malformed memcached keys. Full description

March 4, 2020 - CVE 2020-9402Link to this heading#

Potential SQL injection via tolerance parameter in GIS functions and aggregates on Oracle. Full description

February 3, 2020 - CVE 2020-7471Link to this heading#

Potential SQL injection via StringAgg(delimiter). Full description

December 18, 2019 - CVE 2019-19844Link to this heading#

Potential account hijack via password reset form. Full description

December 2, 2019 - CVE 2019-19118Link to this heading#

Privilege escalation in the Django admin. Full description

August 1, 2019 - CVE 2019-14235Link to this heading#

Potential memory exhaustion in django.utils.encoding.uri_to_iri(). Full description

August 1, 2019 - CVE 2019-14234Link to this heading#

SQL injection possibility in key and index lookups for JSONField/HStoreField. Full description

August 1, 2019 - CVE 2019-14233Link to this heading#

Denial-of-service possibility in strip_tags(). Full description

August 1, 2019 - CVE 2019-14232Link to this heading#

Denial-of-service possibility in django.utils.text.Truncator. Full description

July 1, 2019 - CVE 2019-12781Link to this heading#

Incorrect HTTP detection with reverse-proxy connecting via HTTPS. Full description

June 3, 2019 - CVE 2019-12308Link to this heading#

XSS via "Current URL" link generated by AdminURLFieldWidget. Full description

June 3, 2019 - CVE 2019-11358Link to this heading#

Prototype pollution in bundled jQuery. Full description

February 11, 2019 - CVE 2019-6975Link to this heading#

Memory exhaustion in django.utils.numberformat.format(). Full description

January 4, 2019 - CVE 2019-3498Link to this heading#

Content spoofing possibility in the default 404 page. Full description

October 1, 2018 - CVE 2018-16984Link to this heading#

Password hash disclosure to "view only" admin users. Full description

August 1, 2018 - CVE 2018-14574Link to this heading#

Open redirect possibility in CommonMiddleware. Full description

March 6, 2018 - CVE 2018-7537Link to this heading#

Denial-of-service possibility in truncatechars_html and truncatewords_html template filters. Full description

March 6, 2018 - CVE 2018-7536Link to this heading#

Denial-of-service possibility in urlize and urlizetrunc template filters. Full description

February 1, 2018 - CVE 2018-6188Link to this heading#

Information leakage in AuthenticationForm. Full description

5 September 2017 - CVE 2017-12794Link to this heading#

Kemungkinan XSS di melacak kembali bagian dari halaman teknis mencari kesalahan 500. Full description

4 April 2017 - CVE 2017-7234Link to this heading#

Membuka kerentanan pangalihan dalam django.views.static.serve(). Full description

4 April 2017 - CVE 2017-7233Link to this heading#

Dibuka pengalihan dan kemungkinan serangan XSS melalui URL pengalihan numerik disokong-pengguna. Full description

1 November 2016 - CVE 2016-9014Link to this heading#

Kerentanan mengikat kembali ketika DEBUG=True. Full description

1 November 2016 - CVE 2016-9013Link to this heading#

Pengguna dengan sandi kode keras sandi dibuat ketika menjalankan percobaan pada Oracle. Full description

26 September 2016 - CVE 2016-7401Link to this heading#

Pemotongan perlindungan CSRF pada situs dengan Google Analytics. Full description

18 Juli 2016 - CVE 2016-6186Link to this heading#

XSS dalam popup terkait tambah/rubah admin. Full description

1 Maret 2016 - CVE 2016-2513Link to this heading#

Pendaftaran pengguna melalui perbedaan pewaktu pada peningkatan faktor pekerjaan pengacak sandi. Full description

1 Maret 2016 - CVE 2016-2512Link to this heading#

Pengalihan dan kemungkinsn serangan XSS jelek melalui URL pengalihan diberikan-pengguna mengandung autentifikasi dasar. Full description

1 Februari 2016 - CVE 2016-2048Link to this heading#

Pengguna dengan "change" tetapi tidak "add" perizinan dapat membuat obyek untuk ModelAdmin dengan save_as=True. Full description

24 November 2015 - CVE 2015-8213Link to this heading#

Menyetel kemungkinan bocor di penyaring cetakan date. Full description

18 Agustus 2015 - CVE 2015-5963 / CVE 2015-5964Link to this heading#

Kemungkinan denial-of-service di tampilan logout() dengan mengisi toko sesi. Full description

8 Juli 2015 - CVE 2015-5145Link to this heading#

Kemungkinan denial-of-service di pengesahan URL. Full description

8 Juli 2015 - CVE 2015-5144Link to this heading#

Kemungkinan suntikan kepala sejak pengesah menerima baris baru di masukan. Full description

8 Juli 2015 - CVE 2015-5143Link to this heading#

Kemungkinan denial-of-service dengan mengisi toko sesi. Full description

20 Mei 2015 - CVE 2015-3982Link to this heading#

Diperbaiki pembilasan sesi di backend cached_db. Full description

18 Maret 2015 - CVE 2015-2317Link to this heading#

Dikurangi kemungkinan serangan XSS melalui URL pengalihan diberikan-pengguna. Full description

18 Maret 2015 - CVE 2015-2316Link to this heading#

Kemungkinan denial-of-service dengan strip_tags(). Full description

9 Maret 2015 - CVE 2015-2241Link to this heading#

Serangan XSS melalui sifat di ModelAdmin.readonly_fields. Full description

13 januari 2015 - CVE 2015-0222Link to this heading#

Denial-of-service basisdata dengan ModelMultipleChoiceField. Full description

13 Januari 2015 - CVE 2015-0221Link to this heading#

Serangan denial-of-service terhadap django.views.static.serve(). Full description

13 Januari 2015 - CVE 2015-0220Link to this heading#

Dikurangi kemungkinan serangan XSS melalui URL pengalihan diberikan-pengguna. Full description

13 Januari 2015 - CVE 2015-0219Link to this heading#

Menipu kepala WSGI melalui garis bawah/penggabungan tanda garis. Full description

20 Agustus 2014 - CVE 2014-0483Link to this heading#

Kebocoran data melalui memanipulasi querystring di admin. Full description

20 Agustus 2014 - CVE 2014-0482Link to this heading#

Pembajakan sesi RemoteUserMiddleware. Full description

20 Agustus 2014 - CVE 2014-0481Link to this heading#

Unggah berkas denial of service. Full description

20 Agustus 2014 - CVE 2014-0480Link to this heading#

reverse()` dapat membangkitkan URL menunjuk ke rumah lain. Full description

18 Mei 2014 - CVE 2014-3730Link to this heading#

URL jelek dari masukan pengguna tidak benar disahkan. Full description

18 Mei 2014 - CVE 2014-1418Link to this heading#

Tembolok mungkin diizinkan untuk menyimpan dan melayani data pribadi. Full description

21 April 2014 - CVE 2014-0474Link to this heading#

Typecast MySQL menyebabkan hasil permintaan yang tidak diharapkan. Full description

21 April 2014 - CVE 2014-0473Link to this heading#

Cache dari halaman anonim dapat mengungkap token CSRF. Full description

21 April 2014 - CVE 2014-0472Link to this heading#

Pengerjaan kode tidak diharapkan menggunakan reverse(). Full description

14 September 2013 - CVE 2013-1443Link to this heading#

Denial-of-service melalui sandi besar. Full description

10 September 2013 - CVE 2013-4315Link to this heading#

Lintasan-direktori melalui etiket cetakan ssi. Full description

13 Agustus 2013 - CVE 2013-6044Link to this heading#

Kemungkinan XSS melalui skema pengalihan URL tidak disahkan. Full description

13 Agustus 2013 - CVE 2013-4249Link to this heading#

XSS melalui nilai-nilai URLField dipercaya admin. Full description

19 Februari 2013 - CVE 2013-0306Link to this heading#

Denial-of-service melalui memotong max_num formset. Full description

19 Februari 2013 - CVE 2013-0305Link to this heading#

Kebocoran informasi melalui catatan riwayat admin. Full description

19 Februari 2013 - CVE 2013-1664 / CVE 2013-1665Link to this heading#

Serangan berdasarkan-masukan terhadap pustaka XML Python. Full description

Februari 19, 2013 - No CVELink to this heading#

Tambahan pengerasan dari penanganan kepala Host. Full description

Desember 10, 2012 - No CVE 2Link to this heading#

Tambahan pengerasan dari pengalihan pengesahan. Full description

Desember 10, 2012 - No CVE 1Link to this heading#

Tambahan pengerasan dari penanganan kepala Host. Full description

17 Oktober 2012 - CVE 2012-4520Link to this heading#

Peracunan kepala Host. Full description

30 Juli 2012 - CVE 2012-3444Link to this heading#

Denial-of-service melalui berkas-berkas gambar. Full description

30 Juli 2012 - CVE 2012-3443Link to this heading#

Denial-of-service melalui berkas-berkas gambar termampatkan. Full description

30 Juli 2012 - CVE 2012-3442Link to this heading#

XSS melalui kegagalan untuk mensahkan skema pengalihan. Full description

9 September 2011 - CVE 2011-4140Link to this heading#

Kemungkinan CSRF melalui kepala Host. Full description

9 September 2011 - CVE 2011-4139Link to this heading#

Peracunan cache kepala Host. Full description

9 September 2011 - CVE 2011-4138Link to this heading#

Pengeluaran permintaan kebocoran/berubah-ubah informasi melalui URLField.verify_exists. Full description

9 September 2011 - CVE 2011-4137Link to this heading#

Denial-of-service melalui URLField.verify_exists. Full description

9 September 2011 - CVE 2011-4136Link to this heading#

Manipulasi sesi ketika menggunakan sesi backend-cache-memori. Full description

8 Februari 2011 - CVE 2011-0698Link to this heading#

Lintasan-direktori pada Windows melalui penanganan pemisah-jalur tidak benar. Full description

8 Februari 2011 - CVE 2011-0697Link to this heading#

XSS melalui nama-nama tidak dibersihkan dari berkas-berkas terunggah. Full description

8 Februari 2011 - CVE 2011-0696Link to this heading#

CSRF melalui kepala HTTP yang ditempa. Full description

22 Desember 2010 - CVE 2010-4535Link to this heading#

Denial-of-service di mekanisme setel kembali-sandi. Full description

22 Desember 2010 - CVE 2010-4534Link to this heading#

Kebocoran informasi di antarmuka administratif. Full description

8 September 2010 - CVE 2010-3082Link to this heading#

XSS melalui nilai kue tidak aman dipercaya. Full description

9 Oktober 2009 - CVE 2009-3965Link to this heading#

Denial-of-service melalui penampilan pernyataan regular patologi. Full description

28 Juli 2009 - CVE 2009-2659Link to this heading#

Lintasan-direktori dalam penangan media peladen pengembangan. Full description

2 September 2008 - CVE 2008-3909Link to this heading#

CSRF melalui pemeliharaan dari data POST selama masuk admin. Full description

14 mei 2008 - CVE 2008-2302Link to this heading#

XSS melalui pengalihan masuk admin. Full description

26 Oktober 2007 - CVE 2007-5712Link to this heading#

Denial-of-service melalui kepala Accept-Language besar-berubah-ubah. Full description

21 Januari 2007 - CVE 2007-0405Link to this heading#

Kejelasan "caching" dari pengguna terautentifikasi. Full description

16 Agustus 2006 - CVE 2007-0404Link to this heading#

Masalah pengesahan nama berkas di terjemahan kerangka kerja. Full description