Django — свободный фреймворк для веб-приложений на языке Python, использующий шаблон проектирования MVC
Релизный цикл, информация об уязвимостях
График релизов
Количество 877
BDU:2023-09092
Уязвимость программной платформы для веб-приложений Django, связанная с загрузкой кода без проверки его целостности, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
GHSA-p64x-8rxx-wf6q
Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0 ...
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
GHSA-59w8-4wm2-4xw8
Django Image Field Vulnerable to Image Decompression Bombs
GHSA-5h2q-4hrp-v9rr
Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer
GHSA-78vx-ggch-wghm
Django Allows Redirect via Data URL
GHSA-2655-q453-22f9
Django Allows Arbitrary URL Generation
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | BDU:2023-09092 Уязвимость программной платформы для веб-приложений Django, связанная с загрузкой кода без проверки его целостности, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании | CVSS3: 8.8 | 1% Низкий | почти 4 года назад |
| GHSA-p64x-8rxx-wf6q Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection | CVSS3: 9.8 | 73% Высокий | около 4 лет назад |
 | CVE-2022-34265 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. | CVSS3: 9.8 | 73% Высокий | около 4 лет назад |
| CVE-2022-34265 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0 ... | CVSS3: 9.8 | 73% Высокий | около 4 лет назад |
 | CVE-2022-34265 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. | CVSS3: 9.8 | 73% Высокий | около 4 лет назад |
 | CVE-2022-34265 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. | CVSS3: 9.8 | 73% Высокий | около 4 лет назад |
| GHSA-59w8-4wm2-4xw8 Django Image Field Vulnerable to Image Decompression Bombs | CVSS3: 7.5 | 3% Низкий | около 4 лет назад |
| GHSA-5h2q-4hrp-v9rr Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer | CVSS3: 7.5 | 2% Низкий | около 4 лет назад |
| GHSA-78vx-ggch-wghm Django Allows Redirect via Data URL | CVSS3: 6.1 | 2% Низкий | около 4 лет назад |
| GHSA-2655-q453-22f9 Django Allows Arbitrary URL Generation | CVSS3: 7.5 | 4% Низкий | около 4 лет назад |
Уязвимостей на страницу