Django — свободный фреймворк для веб-приложений на языке Python, использующий шаблон проектирования MVC
Релизный цикл, информация об уязвимостях
График релизов
Количество 751
CVE-2015-5145
validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
CVE-2015-5144
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
BDU:2015-11591
Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2015-11592
Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании
CVE-2015-5145
validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
CVE-2015-5143
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
CVE-2015-5144
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
CVE-2015-3982
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
CVE-2015-3982
The session.flush function in the cached_db backend in Django 1.8.x be ...
CVE-2015-3982
The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2015-5145 validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. | CVSS2: 7.8 | 1% Низкий | больше 10 лет назад |
| CVE-2015-5144 Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. | CVSS2: 4.3 | 2% Низкий | больше 10 лет назад |
 | BDU:2015-11591 Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании | CVSS2: 7.8 | 16% Средний | больше 10 лет назад |
| BDU:2015-11592 Уязвимость программной платформы для веб-приложений Django, позволяющая нарушителю вызвать отказ в обслуживании | CVSS2: 4.3 | 2% Низкий | больше 10 лет назад |
 | CVE-2015-5145 validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. | CVSS2: 5 | 1% Низкий | больше 10 лет назад |
| CVE-2015-5143 The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys. | CVSS2: 5 | 16% Средний | больше 10 лет назад |
| CVE-2015-5144 Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator. | CVSS2: 4.3 | 2% Низкий | больше 10 лет назад |
 | CVE-2015-3982 The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. | CVSS2: 5 | 0% Низкий | больше 10 лет назад |
| CVE-2015-3982 The session.flush function in the cached_db backend in Django 1.8.x be ... | CVSS2: 5 | 0% Низкий | больше 10 лет назад |
| CVE-2015-3982 The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key. | CVSS2: 5 | 0% Низкий | больше 10 лет назад |
Уязвимостей на страницу