.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

django 4.2.7 vulnerabilities

162 advisories known · django@4.2.7 · 46 affect this release · Dependencies not checked · showing 62 more

SEVERITYADVISORYPUBLISHED

Does not affect 4.2.7

SEVERITYADVISORYPUBLISHED

HighDjango allows user sessions hijacking via an empty string in the session keyGHSA-6wgp-fwfm-mxp3CVE-2015-3982PYSEC-2015-19Affected >=1.8a1 <1.8.2Fixed in 1.8.2OSV source ↗11 years ago

HighDjango database denial-of-service with ModelMultipleChoiceFieldGHSA-6g95-x6cj-mg4vCVE-2015-0222PYSEC-2015-7Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

HighDjango DoS in django.views.static.serveGHSA-jhjg-w2cp-5j44CVE-2015-0221PYSEC-2015-6Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

HighDenial of service in djangoGHSA-3jqw-crqj-w8qwCVE-2011-4137PYSEC-2011-2Affected <1.2.7, >=1.3 <1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗15 years ago

HighDjango Cross-Site Request Forgery vulnerabilityGHSA-h95j-h2rv-qrg4CVE-2011-4140PYSEC-2011-5Affected <=1.2.7, >=1.3 <=1.3.1, ==1.2.7, ==1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗15 years ago

HighCross-site request forgery in DjangoGHSA-5j2h-h5hg-3wf8CVE-2011-0696PYSEC-2011-10Affected >=1.1 <1.1.4, >=1.2 <1.2.5Fixed in 1.1.4 Fixed in 1.2.5OSV source ↗16 years ago

HighImproper date handling in DjangoGHSA-7wph-fc4w-wqp2CVE-2010-4535PYSEC-2011-9Affected <1.1.3, >=1.2 <1.2.4Fixed in 1.1.3 Fixed in 1.2.4OSV source ↗16 years ago

HighDjango XSS VulnerabilityGHSA-pw27-w7w4-9qc7CVE-2016-2512PYSEC-2016-15Affected <1.8.10, >=1.9a1 <1.9.3Fixed in 1.8.10 Fixed in 1.9.3OSV source ↗11 years ago

HighDjango Vulnerable to Cache PoisoningGHSA-q7q2-qf2q-rw3wCVE-2014-1418PYSEC-2014-19Affected >=1.4 <1.4.13, >=1.5 <1.5.8, >=1.6 <1.6.5, >=1.7a0 <1.7b4Fixed in 1.4.13 Fixed in 1.5.8 Fixed in 1.6.5 Fixed in 1.7b4OSV source ↗12 years ago

HighPotential bypass of an upstream access control based on URL paths in DjangoGHSA-v6rh-hp5x-86rvBIT-django-2021-44420CVE-2021-44420PYSEC-2021-439Affected >=2.2a1 <2.2.25, >=3.0a1 <3.1.14, >=3.2a1 <3.2.10Fixed in 2.2.25 Fixed in 3.1.14 Fixed in 3.2.10OSV source ↗5 years ago

MediumDjango Middleware Enables Session HijackingGHSA-625g-gx8c-xcmgCVE-2014-0482PYSEC-2014-6Affected <1.4.14, >=1.5 <1.5.9, >=1.6 <1.6.6, >=1.7a1 <1.7c3Fixed in 1.4.14 Fixed in 1.5.9 Fixed in 1.6.6 Fixed in 1.7c3OSV source ↗4 years ago

MediumDjango allows unintended model editingGHSA-hvmf-r92r-27hrCVE-2019-19118PYSEC-2019-15Affected >=2.1 <2.1.15, >=2.2 <2.2.8Fixed in 2.1.15 Fixed in 2.2.8OSV source ↗7 years ago

MediumImproper Input Validation in DjangoGHSA-337x-4q8g-prc5CVE-2019-3498PYSEC-2019-17Affected >=1.11a1 <1.11.18, >=2.0a1 <2.0.10, >=2.1a1 <2.1.5Fixed in 1.11.18 Fixed in 2.0.10 Fixed in 2.1.5OSV source ↗8 years ago

MediumImproper query string handling in DjangoGHSA-fwr5-q9rx-294fCVE-2010-4534PYSEC-2011-8Affected <1.1.3, >=1.2 <1.2.4Fixed in 1.1.3 Fixed in 1.2.4OSV source ↗16 years ago

MediumXSS in jQuery as used in Drupal, Backdrop CMS, and other productsGHSA-6c3j-c64m-qhgqCVE-2019-11358DRUPAL-CORE-2019-006PYSEC-2026-628SNYK-JS-JQUERY-174006Affected >=2.0a1 <2.1.9, >=2.2a1 <2.2.2Fixed in 2.1.9 Fixed in 2.2.2OSV source ↗4 months ago

MediumDjango Allows Redirect via Data URLGHSA-78vx-ggch-wghmCVE-2012-3442PYSEC-2012-2Affected <1.3.2, >=1.4 <1.4.1Fixed in 1.3.2 Fixed in 1.4.1OSV source ↗4 years ago

MediumDjango cross-site scripting (XSS) attack via user-supplied redirect URLsGHSA-7fq8-4pv5-5w5cCVE-2015-2317PYSEC-2015-9Affected <1.4.20, >=1.5 <1.6.11, >=1.7 <1.7.7, >=1.8a0 <1.8c1Fixed in 1.4.20 Fixed in 1.6.11 Fixed in 1.7.7 Fixed in 1.8c1OSV source ↗4 years ago

MediumDjango Cross-site scripting (XSS) vulnerabilityGHSA-54qj-48vx-cr9fCVE-2008-2302PYSEC-2008-1Affected <1.1Fixed in 0.91.2 Fixed in 0.95.3 Fixed in 0.96.2 Fixed in 1.1OSV source ↗5 years ago

MediumCross-site Scripting in DjangoGHSA-95rw-fx8r-36v6BIT-django-2022-22818CVE-2022-22818PYSEC-2022-19Affected >=2.2 <2.2.27, >=3.2 <3.2.12, >=4.0 <4.0.2Fixed in 2.2.27 Fixed in 3.2.12 Fixed in 4.0.2OSV source ↗5 years ago

MediumHeader injection possible in DjangoGHSA-qm57-vhq3-3fwfBIT-django-2021-32052CVE-2021-32052PYSEC-2021-8Affected >=2.2 <2.2.22, >=3.1 <3.1.10, >=3.2 <3.2.2Fixed in 2.2.22 Fixed in 3.1.10 Fixed in 3.2.2OSV source ↗6 years ago

MediumXSS in DjangoGHSA-2m34-jcjv-45xfBIT-django-2020-13596CVE-2020-13596PYSEC-2020-32Affected >=2.2a1 <2.2.13, >=3.0a1 <3.0.7Fixed in 2.2.13 Fixed in 3.0.7OSV source ↗6 years ago

MediumDjango Cross-site Scripting in AdminURLFieldWidgetGHSA-7rp2-fm2h-wchjCVE-2019-12308PYSEC-2019-79Affected >=1.11a1 <1.11.21, >=2.1a1 <2.1.9, >=2.2a1 <2.2.2Fixed in 1.11.21 Fixed in 2.1.9 Fixed in 2.2.2OSV source ↗7 years ago

MediumDjango vulnerable to XSS on 500 pagesGHSA-9r8w-6x8c-6jr9CVE-2017-12794PYSEC-2017-44Affected >=1.10a1 <1.10.8, >=1.11a1 <1.11.5Fixed in 1.10.8 Fixed in 1.11.5OSV source ↗8 years ago

MediumDjango open redirect and possible XSS attack via user-supplied numeric redirect URLsGHSA-37hp-765x-j95xCVE-2017-7233PYSEC-2017-9Affected >=1.10a1 <1.10.7, >=1.8a1 <1.8.18, >=1.9a1 <1.9.13Fixed in 1.10.7 Fixed in 1.8.18 Fixed in 1.9.13OSV source ↗8 years ago

MediumDjango open redirectGHSA-h4hv-m4h4-mhwgCVE-2017-7234PYSEC-2017-10Affected >=1.10 <1.10.7, >=1.8 <1.8.18, >=1.9 <1.9.13Fixed in 1.10.7 Fixed in 1.8.18 Fixed in 1.9.13OSV source ↗8 years ago

MediumDjango open redirectGHSA-5hg3-6c2f-f3wrCVE-2018-14574PYSEC-2018-2Affected >=1.11 <1.11.15, >=2.0 <2.0.8Fixed in 1.11.15 Fixed in 2.0.8OSV source ↗8 years ago

MediumDjango Cross-site scripting VulnerabilityGHSA-c8c8-9472-w52hCVE-2016-6186PYSEC-2016-2Affected <1.8.14, >=1.10a0 <1.10rc1, >=1.9 <1.9.8, 1.9a1 - 1.9rc2Fixed in 1.10rc1 Fixed in 1.8.14 Fixed in 1.9.8OSV source ↗10 years ago

MediumDjango Cross-site Scripting VulnerabilityGHSA-6565-fg86-6jcxCVE-2015-2241PYSEC-2015-8Affected <1.7.6, >=1.8a1 <1.8b2Fixed in 1.7.6 Fixed in 1.8b2OSV source ↗12 years ago

MediumDjango Cross-site Scripting VulnerabilityGHSA-gv98-g628-m9x5CVE-2015-0220PYSEC-2015-5Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

MediumDjango cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widgetGHSA-4894-5vqc-6r2rCVE-2013-4249PYSEC-2013-19Affected >=1.5 <1.5.2, ==1.1, 1.2 - 1.2.1, ==1.3, ==1.4, ==1.0, ==1.5a1, ==1.5b1, ==1.5b2, ==1.5c1+1 more ranges Fixed in 1.5.2OSV source ↗13 years ago

MediumDjango cross-site scripting (XSS) vulnerability via is_safe_url function GHSA-9cwg-mhxf-hh59CVE-2013-6044PYSEC-2013-21Affected >=1.4 <1.4.6, >=1.5 <1.5.2, ==1.1, 1.2 - 1.2.1, ==1.3, ==1.0, ==1.5a1, ==1.5b1, ==1.5b2, ==1.5c1+1 more ranges Fixed in 1.4.6 Fixed in 1.5.2OSV source ↗13 years ago

MediumCross-site scripting in djangoGHSA-8m3r-rv5g-fcpqCVE-2011-0697PYSEC-2011-11Affected >=1.1 <1.1.4, >=1.2 <1.2.5Fixed in 1.1.4 Fixed in 1.2.5OSV source ↗16 years ago

MediumCross-site scripting in djangoGHSA-fxpg-gg9g-76gjCVE-2010-3082PYSEC-2010-12Affected >=1.2 <1.2.2Fixed in 1.2.2OSV source ↗16 years ago

MediumXML Entity Expansion (XEE) in DjangoGHSA-qrh7-x6fp-c2mpCVE-2013-1664PYSEC-2026-801Affected >=1.3.0 <1.3.6, >=1.4.0 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗4 months ago

MediumXML External Entity (XXE) in DjangoGHSA-x64m-686f-fmm3CVE-2013-1665PYSEC-2026-802Affected >=1.3.0 <1.3.6, >=1.4.0 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗4 months ago

MediumDjango Improper Access ControlGHSA-mwv2-398h-v489CVE-2007-0405PYSEC-2026-629Affected >=0.95 <1.0Fixed in 1.0OSV source ↗5 years ago

MediumDjango Denial-of-service in django.utils.text.TruncatorGHSA-h8gc-pgj2-vjm3BIT-django-2023-43665CVE-2023-43665PYSEC-2023-226Affected >=3.2a1 <3.2.22, >=4.1a1 <4.1.12, >=4.2a1 <4.2.6Fixed in 3.2.22 Fixed in 4.1.12 Fixed in 4.2.6OSV source ↗3 years ago

MediumDjango vulnerable to Denial of Service via i18n middleware componentGHSA-9v8h-57gv-qch6CVE-2007-5712PYSEC-2007-1Affected <1.1Fixed in 0.91.1 Fixed in 0.95.2 Fixed in 0.96.1 Fixed in 1.1OSV source ↗5 years ago

MediumData leakage via cache key collision in DjangoGHSA-wpjr-j57x-wxfwBIT-django-2020-13254CVE-2020-13254PYSEC-2020-31Affected >=2.2 <2.2.13, >=3.0 <3.0.7Fixed in 2.2.13 Fixed in 3.0.7OSV source ↗6 years ago

MediumDjango Potential Denial of Service (DoS) on Windows GHSA-wqfg-m96j-85vmBIT-django-2025-27556CVE-2025-27556PYSEC-2025-14Affected >=5.0 <5.0.14, >=5.1 <5.1.8Fixed in 5.0.14 Fixed in 5.1.8OSV source ↗2 years ago

MediumDjango Access Restrictions Bypass GHSA-46x4-9jmv-jc8pCVE-2016-2048PYSEC-2016-14Affected >=1.9 <1.9.2Fixed in 1.9.2OSV source ↗11 years ago

MediumDjango has an Improper Handling of Length Parameter InconsistencyGHSA-w26r-rmm8-9c29BIT-django-2026-5766CVE-2026-5766PYSEC-2026-54Affected >=5.2 <5.2.14, >=6.0 <6.0.5Fixed in 5.2.14 Fixed in 6.0.5OSV source ↗6 months ago

MediumDjango Denial of service vulnerability in django.utils.encoding.uri_to_iriGHSA-7h4p-27mh-hmrwBIT-django-2023-41164CVE-2023-41164PYSEC-2023-225Affected >=3.2 <3.2.21, >=4.1 <4.1.11, >=4.2 <4.2.5Fixed in 3.2.21 Fixed in 4.1.11 Fixed in 4.2.5OSV source ↗3 years ago

MediumDjango data leakage via querystring manipulation in adminGHSA-rw75-m7gp-92m3CVE-2014-0483PYSEC-2014-7Affected <1.4.14, >=1.5 <1.5.9, >=1.6 <1.6.6, >=1.7a1 <1.7c3Fixed in 1.4.14 Fixed in 1.5.9 Fixed in 1.6.6 Fixed in 1.7c3OSV source ↗4 years ago

MediumDirectory-traversal in DjangoGHSA-jrh2-hc4r-7jwxBIT-django-2021-45452CVE-2021-45452PYSEC-2022-3Affected >=2.2 <2.2.26, >=3.2 <3.2.11, >=4.0 <4.0.1Fixed in 2.2.26 Fixed in 3.2.11 Fixed in 4.0.1OSV source ↗5 years ago

MediumDirectory Traversal in DjangoGHSA-xgxc-v2qg-chmhBIT-django-2021-28658CVE-2021-28658PYSEC-2021-6Affected >=2.2a1 <2.2.20, >=3.0a1 <3.0.14, >=3.1a1 <3.1.8Fixed in 2.2.20 Fixed in 3.0.14 Fixed in 3.1.8OSV source ↗6 years ago

MediumDjango Directory Traversal via archive.extractGHSA-fvgf-6h6h-3322BIT-django-2021-3281CVE-2021-3281PYSEC-2021-9Affected >=2.2 <2.2.18, >=3.0 <3.0.12, >=3.1 <3.1.6Fixed in 2.2.18 Fixed in 3.0.12 Fixed in 3.1.6OSV source ↗6 years ago

MediumDjango Incorrect HTTP detection with reverse-proxy connecting via HTTPSGHSA-6c7v-2f49-8h26CVE-2019-12781PYSEC-2019-10Affected >=1.11 <1.11.22, >=2.1 <2.1.10, >=2.2 <2.2.3Fixed in 1.11.22 Fixed in 2.1.10 Fixed in 2.2.3OSV source ↗7 years ago

MediumDjango denial-of-service possibility in urlize and urlizetrunc template filtersGHSA-r28v-mw67-m5p9CVE-2018-7536PYSEC-2018-5Affected >=1.11a1 <1.11.11, >=1.8a1 <1.8.19, >=2.0a1 <2.0.3Fixed in 1.11.11 Fixed in 1.8.19 Fixed in 2.0.3OSV source ↗8 years ago

MediumDjango Denial-of-service possibility in truncatechars_html and truncatewords_html template filtersGHSA-2f9x-5v75-3qv4CVE-2018-7537PYSEC-2018-6Affected >=1.11 <1.11.11, >=1.8 <1.8.19, >=2.0 <2.0.3Fixed in 1.11.11 Fixed in 1.8.19 Fixed in 2.0.3OSV source ↗8 years ago

MediumDjango WSGI Header Spoofing VulnerabilityGHSA-7qfw-j7hp-v45gCVE-2015-0219PYSEC-2015-4Affected <1.4.18, >=1.5 <1.6.10, >=1.7 <1.7.3Fixed in 1.4.18 Fixed in 1.6.10 Fixed in 1.7.3OSV source ↗12 years ago

MediumDjango is vulnerable to Denial of Service attack in formset GHSA-g8xg-jgj6-49r3CVE-2013-0306PYSEC-2013-17Affected >=1.3 <1.3.6, >=1.4 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗14 years ago

MediumPath Traversal in DjangoGHSA-68w8-qjq3-2gfmBIT-django-2021-33203CVE-2021-33203PYSEC-2021-98Affected <2.2.24, >=3.0 <3.1.12, >=3.2 <3.2.4Fixed in 2.2.24 Fixed in 3.1.12 Fixed in 3.2.4OSV source ↗5 years ago

MediumDjango allows unprivileged users to read the password hashes of arbitrary accountsGHSA-6mx3-3vqg-hpp2CVE-2018-16984PYSEC-2018-3Affected >=2.1 <2.1.2Fixed in 2.1.2OSV source ↗8 years ago

MediumDjango Uses Cache Containing Sensitive InformationGHSA-5hrc-gvxj-w55pBIT-django-2026-6907CVE-2026-6907PYSEC-2026-55Affected >=5.2 <5.2.14, >=6.0 <6.0.5Fixed in 5.2.14 Fixed in 6.0.5OSV source ↗6 months ago

MediumDjango Data leakage via admin history logGHSA-r7w6-p47g-vj53CVE-2013-0305PYSEC-2013-16Affected >=1.3 <1.3.6, >=1.4 <1.4.4Fixed in 1.3.6 Fixed in 1.4.4OSV source ↗14 years ago

MediumSession manipulation in DjangoGHSA-x88j-93vc-wpmpCVE-2011-4136PYSEC-2011-1Affected <1.2.7, >=1.3 <1.3.1Fixed in 1.2.7 Fixed in 1.3.1OSV source ↗15 years ago

LowDjango fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshakeGHSA-mm6v-q8q9-pgcfBIT-django-2026-7666CVE-2026-7666PYSEC-2026-200Affected >=5.2 <5.2.15, >=6.0 <6.0.6Fixed in 5.2.15 Fixed in 6.0.6OSV source ↗5 months ago

LowDjango: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from VaryGHSA-qpc8-7fxc-cm4pBIT-django-2026-35193CVE-2026-35193PYSEC-2026-197Affected >=5.2 <5.2.15, >=6.0 <6.0.6Fixed in 5.2.15 Fixed in 6.0.6OSV source ↗5 months ago

LowDjango User Enumeration VulnerabilityGHSA-fp6p-5xvw-m74fCVE-2016-2513PYSEC-2016-16Affected <1.8.10, >=1.9 <1.9.3Fixed in 1.8.10 Fixed in 1.9.3OSV source ↗11 years ago

LowDjango Uses Persistent Cookies Containing Sensitive Information GHSA-7h2m-m8vj-598hBIT-django-2026-35192CVE-2026-35192PYSEC-2026-50Affected >=5.2 <5.2.14, >=6.0 <6.0.5Fixed in 5.2.14 Fixed in 6.0.5OSV source ↗6 months ago

LowDjango settings leak in date template filterGHSA-6wcr-wcqm-3mfhCVE-2015-8213PYSEC-2015-11Affected <1.7.11, >=1.8a1 <1.8.7, >=1.9a0 <1.9rc2Fixed in 1.7.11 Fixed in 1.8.7 Fixed in 1.9rc2OSV source ↗11 years ago