Security update for python-Django

Security update for python-Django

Security update for python-Django

Security update for python-Django

Security update for python-Django

Django denial-of-service attack in the intcomma template filter

SQL Injection in Django

Directory Traversal in Django

Session manipulation in Django

Django vulnerable to user enumeration attack

Denial-of-service possibility in logout() view by filling session store

Django Might Allow CSRF Requests via URL Verification

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such...

Django Vulnerable to MySQL Injection

Django Potential Denial of Service (DoS) on Windows

Uncontrolled Memory Consumption in Django

Django has an Improper Handling of Length Parameter Inconsistency

SQL Injection in Django

Django is vulnerable to DoS via XML serializer text extraction

Django Allows Open Redirects