Krytyczna
CVE-2023-43791
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 307
Wyczyść filtry
Wysoka
CVE-2023-43665
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
Średnia
CVE-2023-41164
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large n
Wysoka
CVE-2023-46695
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
Średnia
CVE-2021-46898
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //examp
Wysoka
CVE-2023-36053
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
Niska
CVE-2023-33185
Incorrect signature verification in django-ses
Krytyczna
CVE-2023-31047
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
Wysoka
CVE-2023-28836
Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
Wysoka
ghsa-cpmr-mw4j-99r7
Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/
Wysoka
CVE-2023-26043
GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection
Wysoka
CVE-2023-25657
Nautobot vulnerable to remote code execution via Jinja2 template rendering
Wysoka
CVE-2023-24580
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f
Wysoka
CVE-2023-23969
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s
Średnia
CVE-2016-15010
** UNSUPPPORTED WHEN ASSIGNED **** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerabi
Średnia
CVE-2022-4526
A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photo_detail
Wysoka
CVE-2022-41323
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular
Wysoka
CVE-2022-42731
django-mfa2 vulnerable to MFA Replay attack
Średnia
CVE-2022-36087
OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI
Wysoka
ghsa-pcjh-6r5h-r92r
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
Wysoka
CVE-2022-36359
Django vulnerable to Reflected File Download attack
Krytyczna
CVE-2022-34265
Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
Nieoceniona
CVE-2022-32996
The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user informat
Wysoka
ghsa-x9jp-4w8m-4f3c
Cross Site Scripting vulnerability in django-jsonform's admin form.
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.