Поиск уязвимостей
Количество 9
Количество 9
BDU:2019-03594
Уязвимость функций django.contrib.postgres.fields.HStoreField и django.contrib.postgres.fields.JSONField фреймворка Django, связанная с отсутствием мер по защите структуры запроса SQL, позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
ALT-PU-2019-2365
ALT-PU-2019-2365: package `python3-module-django2.2` update to version 2.2.4-alt1
ALT-PU-2019-2364
ALT-PU-2019-2364: package `python-module-django` update to version 1.11.23-alt1
CVE-2019-14234
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
CVE-2019-14234
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
CVE-2019-14234
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
CVE-2019-14234
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before ...
GHSA-6r97-cj55-9hrq
SQL Injection in Django
openSUSE-SU-2019:1839-1
Security update for python-Django
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2019-03594 Уязвимость функций django.contrib.postgres.fields.HStoreField и django.contrib.postgres.fields.JSONField фреймворка Django, связанная с отсутствием мер по защите структуры запроса SQL, позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании | CVSS3: 9.8 | 48% Средний | больше 7 лет назад |
| ALT-PU-2019-2365 ALT-PU-2019-2365: package `python3-module-django2.2` update to version 2.2.4-alt1 | CVSS3: 9.8 | больше 7 лет назад | |
| ALT-PU-2019-2364 ALT-PU-2019-2364: package `python-module-django` update to version 1.11.23-alt1 | CVSS3: 9.8 | больше 7 лет назад | |
 | CVE-2019-14234 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function. | CVSS3: 9.8 | 48% Средний | больше 7 лет назад |
 | CVE-2019-14234 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function. | CVSS3: 5.3 | 48% Средний | больше 7 лет назад |
 | CVE-2019-14234 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function. | CVSS3: 9.8 | 48% Средний | больше 7 лет назад |
| CVE-2019-14234 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before ... | CVSS3: 9.8 | 48% Средний | больше 7 лет назад |
| GHSA-6r97-cj55-9hrq SQL Injection in Django | CVSS3: 9.8 | 48% Средний | около 7 лет назад |
 | openSUSE-SU-2019:1839-1 Security update for python-Django | больше 7 лет назад |
Уязвимостей на страницу